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On April 3, 1997, about 1948 eastern standard time, a Cessna 650 (Citation HI), N553AC, 
operated by Mercury Communications, experienced an in-flight fire while on approach to the 
Greater Buffalo International Airport in Buffalo, New York. While descending through 4,000 feet, 
the crew smelled smoke, a navigation display went blank, and radio communications were lost. 
After an emergency landing, ground personnel saw flames burning through a hole in the aft 
fuselage and informed the crew. The flightcrew and passenger evacuated with no injuries; 
however, the airplane was substantially damaged. The flight was being conducted under the 
provisions of Title 14 Code of Federal Regulations Part 91 as a corporate flight from Wellsville, 
New York, to Buffalo. 

The Safety Board's investigation revealed that the fire was caused by arcing between 
115VAC electrical wiring and the hydraulic pump suction line in the area above the baggage 
compartment. A fleetwide inspection of Cessna 650s found that nine airplanes had electrical wiring 
chafing against the same hydraulic line and were at risk of a similar in-flight fire. A subsequent 
Federal Aviation Administration (FAA) airworthiness directive (AD) required all Cessna 650s to be 
modified with the installation of an additional clip and five clamps with associated hardware to 
ensure positive separation between the electrical wires and the hydraulic line. 


The Safety Board is aware of other recent incidents caused by inadequate clearance between 
electrical wiring and adjacent components. On June 25, 1996, Delta Air Lines flight 148, a Boeing 
767-300ER (767), experienced a flight control malfunction after taking off from John F. Kennedy 
International Airport, Jamaica, New York. While climbing through 5,000 feet, the captain heard a 
loud pop, and the airplane banked sharply to the left. The flightcrew had to deflect the control 
wheel 25° to the right to maintain a level attitude; a successful emergency landing was made back in 
New York. The Safety Board's investigation revealed that an aileron flight control cable failed as a 
result of arcing when it contacted adjacent electrical wiring. Several days later, an aileron cable 
failure occurred on a 767 operated by Lan-Chile Airlines under similar circumstances. The FAA 
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issued a telegraphic AD for a fleetwide inspection to ensure that 1 inch of clearance existed between 
the flight control cable and the electrical wiring. 

The Safety Board also learned of a 1995 incident aboard a Japan Air Lines (JAL) 767 in 
which inadequate clearance led to arcing between electrical wiring and an oxygen line fitting near 
the captain’s oxygen mask. This incident was followed by a Boeing service bulletin and an FAA 
AD mandating the installation of protective sleeving over the wiring within 2 inches of the oxygen 
lines as an interim protective measure. A July 2, 1997, proposed AD calls for permanent 
modifications to ensure adequate clearance between oxygen equipment and adjacent wiring. 

Based on these accidents/incidents, the Safety Board performed a review of the FAA 
guidelines for safe wire routing practices. Guidelines were found in two references, Advisory 
Circular (AC) 43.13-1 A, "Acceptable Methods, Techniques, and Practices-Aircraft Inspection And 
Repair," and AC 65-15, "Airframe and Poweiplant Mechanics Airframe Book." (The Safety 
Board recognizes that these advisory circulars provide general wire routing guidelines and that more 
specific guidelines may be provided by the manufacturer.) These references state that no electrical 
wire should be located within 1/2 inch of any combustible fluid or oxygen line, and if the 
separation is less than 2 inches, back-to-back clamps or a polyethylene sleeve should be installed to 
ensure positive separation. They also state that electrical wiring should be routed to maintain 
clearance of at least 3 inches with any control cable. If this clearance cannot be maintained, 
mechanical guards should be installed to prevent contact between the wiring and the control cables. 

The Safety Board reviewed the current company standards and practices used by several 
manufacturers and found that they do not always provide for the clearance around electrical wiring 
recommended in the FAA guidelines. For example, Cessna's process specification, "Wiring 
Installation for Commercial Aircraft," states that wiring shall not be attached to hydraulic lines, and 
that wiring within 6 inches of hydraulic lines must be firmly supported. However, it does not 
mention using back-to-back clamps or a polyethylene sleeve to ensure positive separation if the 
separation is less than 2 inches. Design drawings for the Cessna 650 specify 1/2 inch of clearance 
between the hydraulic line and electrical wiring but provide no means to ensure positive separation. 
The Safety Board recognizes that after the Buffalo, New York, accident, the FAA issued an AD to 
mandate the installation of additional clamps on all Cessna 650s to ensure positive separation. 
However, the Board is concerned that Cessna’s design drawings for the Cessna 650 were not 
consistent with Cessna’s process specifications nor the FAA’s guidance. 

The Boeing Standard Wiring Practices Manual states that electrical wiring should be routed 
at least 3 inches away from control cables, if possible. If this cannot be done, rigid support of the 
wiring must be specified, and if necessary, special mechanical or electrical protection between 
wiring and control cables should be specified. However, design drawings for the 767 specify only 
1 inch of separation between the aileron flight control cable and adjacent electrical wiring, with no 
mechanical or electrical protection specified; this 1 inch separation did not prevent arcing in the 
Delta Air Lines and Lan-Chile Airlines incidents. A Boeing service letter and subsequent AD 



issued after these incidents still require only 1 inch of clearance in this area, with no mechanical 
guards to prevent contact as recommended in the referenced FAA guidelines. 

Finally, the original design of the 767 flightcrew oxygen mask stowage box allowed for 
electrical wiring to be within 2 inches of oxygen lines, with no protective sleeving over the wiring, 
as recommended in the referenced FAA guidelines. However, following the 1995 JAL incident, a 
service bulletin and AD were issued requiring the installation of protective sleeving over the 
electrical wiring. 

The Safety Board concludes that, although not mandated, the FAA guidelines provide 
adequate protection from the hazards associated with inadequate clearance between electrical wiring 
and adjacent components. However, the Board is concerned that manufacturers do not always 
provide this level of protection through their design standards or manufacturing and inspection 
processes. In some cases, manufacturers are required to modify designs to bring them in line with 
the FAA guidelines only after an in-service problem or an accident or incident has occurred. To 
minimize the risks associated with inadequate clearance around electrical wiring, the Safety Board 
believes that the FAA should review the design, manufacturing, and inspection procedures of 
aircraft manufacturers, and require revisions, as necessary, to ensure that adequate clearance is 
specified around electrical wiring, in accordance with published FAA guidelines. In addition, the 
FAA should review the existing designs of all transport-category airplanes to determine if adequate 
clearance is provided around electrical wiring, in accordance with published FAA guidelines. If 
deviations are found, require that modifications be made to ensure adequate clearance. 

Therefore, the National Transportation Safety Board recommends that the Federal Aviation 
Administration: 

Review the design, manufacturing, and inspection procedures of aircraft 
manufacturers, and require revisions, as necessary, to ensure that adequate clearance 
is specified around electrical wiring, in accordance with published FAA guidelines. 
(A-98-1) 

Review the existing designs of all transport-category airplanes to determine if 
adequate clearance is provided around electrical wiring, in accordance with 
published FAA guidelines. If deviations are found, require that modifications be 
made to ensure adequate clearance. (A-98-2) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA, and BLACK concurred in these recommendations. 
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On May 12,1997, at 1529 eastern daylight time, an Airbus Industrie A300B4-605R, N90070, 
operated by American Airlines as flight 903, experienced an in-flight upset at an altitude of 16,000 feet 
near West Palm Beach, Florida. During the upset, the stall warning system activated, the airplane 
rolled to extreme bank angles left and right, and rapidly descended more than 3,000 feet. One 
passenger sustained serious injuries, and the airplane received minor damage. Flight 903 was being 
conducted under the provisions of Title 14 Code of Federal Regulations (CFR) Part 121 as a domestic, 
scheduled passenger service flight from Boston, Massachusetts, to Miami, Florida. 

Although the cause of the in-flight upset is still under investigation, the Safety Board has 
identified several safety issues that it believes the Federal Aviation Administration (FAA) should 
address. 


The A300 is equipped with an electronic flight instrument system (EFIS) that includes two 
primary flight displays (PFDs), which present airspeed, altitude, attitude, and other information needed 
to control the airplane, and two navigation displays (NDs), which present heading and other 
information needed to navigate. These displays are controlled by symbol generator unit (SGU) 
computers, which process inputs from the various sensors and format the data for display. 

During the upset, the captain stated that the EFIS displays were lost for "2 to 3 seconds" and 
that they were replaced by a white diagonal slash mark across the display screens. This loss of EFIS 
displays left only the standby indicators available for attitude, airspeed, and altitude reference. The first 
officer stated that the loss of EFIS displays occurred "when the situation was at its gravest." 

Airbus Industrie informed the Safety Board that the diagonal slash marks displayed on the 
screens during the upset indicated that the SGUs were undergoing an automatic reset and self-test 
involving software that is designed to detect unreliable data. For example, the SGUs monitor changes 
in the airplane's flight parameters, such as roll angle, pitch angle, and airspeed. If any of these 
parameters change at a rate that exceeds a predetermined threshold value, an SGU reset occurs that 
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allows the SGU to perform a self-test for several seconds to determine if the excessive rate-of-change 
is the result of unreliable data. 

The Safety Board learned that the threshold for triggering an automatic reset can be reached 
during an in-flight upset. For example, if the roll angle rate of change is more than 40° per second, a 
reset will occur. According to data from the flight data recorder (FDR), flight 903 experienced a 
change in roll angle in excess of 40° per second during the upset. 

The Safety Board is concerned that the loss of all primary flight information during an upset 
can critically affect a flightcrew's ability to recover the airplane. According to Airbus Industrie, this is 
the first instance in which an SGU reset was reported during an upset. However, the Safety Board has 
investigated numerous upsets 1 on large, transport-category airplanes and has a longstanding concern 
about the need for air carrier pilots to receive training in the recognition of and recovery from unusual 
attitudes and upsets. In its advanced aircraft maneuvering program, American Airlines teaches pilots 
(including A300 flightcrews) to recognize various unusual attitudes on their primary flight displays. 
Loss of information from these displays could adversely affect recognition and recovery from unusual 
attitudes. 

The Safety Board realizes that the intent of the automatic reset feature is to prevent the display 
of erroneous data to the flightcrew; however, it is concerned that the threshold values selected for 
activating this feature cause a reset to occur when accurate data is being displayed during an upset. 
This results in the loss of all primary flight displays at a time when pilots need their critical information 
the most. Therefore, the Safety Board believes that the FAA should require that Airbus Industrie 
modify the SGU computer software installed in the A300 so that an unreliable data reset of the EFIS 
will not occur during an upset. When the modified software is available, the FAA should require that 
all operators install it in the SGUs. 

The effect of SGU failure on the PFDs is outlined in the emergency and abnormal procedures 
section of the American Airlines A300 Operating Manual. Thus, pilots should recognize that the 
diagonal slash on EFIS displays results from SGU failure. However, conditions such as the roll rate 
limitation that produce an SGU failure are not addressed, and the potential for EFIS displays to go 
blank during maneuvering is not presented in the chapter on unusual attitude recovery. Knowing that 
the EFIS displays might go blank for several seconds during an upset will better prepare pilots to 
transfer rapidly to standby instrumentation if an SGU reset occurs during maneuvering. Therefore, as 
an interim action, the Safety Board believes that the FAA should issue a flight standards information 
bulletin to direct principal operations inspectors to ensure that A300 operators notify flightcrews of the 
possibility of a temporary loss of EFIS displays during an upset. 


National Transportation Safety Board. 1996. In-flight Icing Encounter and Loss of Control, Simmons 
Airlines, d.b.a. American Eagle Flight 4184, Avions de Transport Regional (ATR) Model 72-212, 
N401AM, Roselawn, Indiana, October 31, 1994. NTSB/AAR-96/01. Washington, D.C.; National 
Transportation Safety Board. 1992. Uncontrolled Collision with Terrain for Undetermined Reasons, 
United Airlines Flight 585, Boeing 737-291, N999UA, Colorado Springs, Colorado, March 3, 1991. 
NTSB/AAR-92/06. Washington, D.C.; National Transportation Safety Board. February 20, 1997. 
Safety Recommendation Letter. Recommendations A-97-16 through -18. 
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Another issue raised in this investigation involves the A300 autothrottle system (ATS). The 
A300 is equipped with an ATS that provides automatic thrust control and can be selected during any 
flight phase. The ATS can be engaged in several modes, including the speed/Mach mode in which 
thrust is controlled to maintain the airspeed or Mach number selected by the flightcrew. The ATS is 
normally engaged via the "A/THR" (automatic throttle) button on the glareshield flight control unit 
panel. When this button is depressed, three green bars illuminate in it, and the ariiber "MAN THR" 
(manual thrust) legend on the flight mode annunciator section of the PFDs is replaced by a green 
legend corresponding to the selected ATS mode. 

Both flightcrew members stated that the ATS was engaged and set to hold an airspeed of 210 
knots at the time of the upset. FDR data indicate that the ATS was engaged at the onset of the descent 
from 24,000 feet. During the descent, the flightcrew moved the power levers from the ATS idle thrust 
setting to the throttle control lever mechanical stops, slightly reducing the thrust. [This technique is 
common among A300 crewmembers since it allows the airplane to descend more quickly, and it can be 
done either with or without disengaging the ATS.] However, when the pilot leveled off at 16,000 feet, 
FDR data indicate that the ATS was not engaged and that the airspeed began to decrease. As the 
airplane slowed to about 170 knots, the flightcrew rapidly advanced the throttles, but the stall warning 
activated and the in-flight upset occurred. Postflight testing found no evidence of ATS malfunction. 
The Safety Board is concerned that the airplane might have been allowed to decelerate well below the 
intended airspeed because the flightcrew believed that the ATS was still engaged when it was not. 

There are a variety of ways that the ATS can be disengaged when a flightcrew wants manual 
control of engine thrust. The most common method is to depress the ATS disconnect button on either 
throttle. This gives the flightcrew manual control of the throttles and causes the ATS mode displayed 
on the PFD to change to an amber MAN THR indication, and the three green bars in the A/THR 
button to extinguish. 

However, other transport-category airplanes similar to the A300 have been designed with 
warning systems that require additional flightcrew action to help ensure flightcrew awareness of 
autothrottle disconnect. For example, after depressing the ATS disconnect button on the McDonnell 
Douglas MD-11, the ATS disconnects, but a flashing, red "ATS OFF" legend appears on the PFD. 
This flashing legend continues until the ATS disconnect button is depressed a second time. Other 
airplanes, such as the Douglas DC-10, MD-80, Boeing 737 (B-737), and Fokker F-100, are designed 
in a similar fashion. Airplanes, such as the B-757, B-767, and B-777, also sound an aural alert that 
continues until the flightcrew confirms that they have manual control of the throttles by depressing one 
of the ATS disconnect buttons a second time. 

The A300 indications of autothrottle disconnect are of a passive, persistent nature (an amber 
MAN THR legend on the PFD and the absence of three green bars in the A/THR button). The Safety 
Board recognizes that these cues can function as a warning; however, their persistent quality is more 
typical of an information display and does not command attention. Since pilot attention typically is not 
drawn to these persistent cues, it is possible for a delay to exist between inadvertent autothrottle 
disconnect and flightcrew recognition of the event. In contrast, warnings that use flashing displays, 
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aural alerts, or that require positive action to silence, function to capture flightcrew attention and help 
ensure recognition. Therefore, in light of this accident, the Safety Board believes that the FAA should 
compare the design of the A300 autothrottle system with similar transport-category airplanes, and 
determine if additional visual/aural warnings are necessary to ensure that flightcrews are aware that 
they have manual control of the throttles. If additional warnings are necessary. Airbus Industrie should 
be required to modify the A300 accordingly. 

Therefore, the Safety Board recommends that the Federal Aviation Administration: 

Require that Airbus Industrie modify the symbol generator unit (SGU) computer 
software installed in the A300 so that an unreliable data reset of the electronic flight 
information system will not occur during an upset. When the modified software is 
available, require that all operators install it in the SGUs. (A-98-3) 

Issue a flight standards information bulletin to direct principal operations inspectors to 
, ensure that Airbus Industrie A300 operators notify flightcrews of the possibility of a 
temporary loss of electronic flight instrument system displays during an upset. 

(A-98-4) 

Compare the design of the A300 autothrottle system with similar transport-category 
airplanes, and determine if additional visual/aural warnings are necessary to ensure that 
flightcrews are aware that they have manual control of the throttles. If additional 
warnings are necessary, Airbus Industrie should be required to modify the A3 00 
accordingly. (A-98-5) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, GOGLIA, 
and BLACK concurred in these recommendations. 
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On August 20, 1997, the left outboard aileron of a Boeing 747-312 (747), operating as 
Ansett Airlines flight 826, deflected to the full-down position while the airplane was taxiing for 
takeoff at Brisbane International Airport, Brisbane, Australia. Postincident examination of the 
aileron control system was conducted by the Bureau of Air Safety Investigation (BASI), 
Commonwealth of Australia. The examination revealed that one of the left aileron cables (AA- 
11) that connect the inboard aileron quadrant to the aileron cable drum was broken. An adjacent 
cable (AB-13) that connects the aileron cable drum to the outboard aileron quadrant via a 
turnaround pulley was frayed. The aileron cable drum forward guide pin exhibited signs of wear 
consistent with abrasion by an aileron control cable. The airplane was manufactured in 1983, 
production line number 590, serial number (S/N) 23029, and had 11,027 cycles and 62,399 hours 
since new. The airplane had been operated 1,022 flight hours since both cables were replaced on 

June 2, 1997. 


The 747 aileron control system comprises a cable loop system and hydraulic aileron 
actuators. Rotation of the cockpit control wheel moves cables routed along the rear spar of the 
wings to provide control inputs to inboard and outboard aileron power control units (PCUs). 

Each wing has two AA and two AB aileron cable assemblies (see Figure 1.), one inboard 
and one outboard. The inboard AA cable run connects the aileron programmer quadrant to the 
aileron cable drum, and the inboard AB cable run connects the same quadrant to the inboard 
aileron PCU quadrant. The outboard AA cable run connects the aileron cable drum to the 
outboard aileron quadrant, and the outboard AB cable run connects the drum to the same 
quadrant via a turnaround pulley. The aileron cable drum, which is located at wing station (WS) 
776.98, is a four-slotted pulley with a guide pin and is used to provide a complete (closed) cable 
loop to the inboard aileron even if the outboard segment is lost because of malfunction. The 
guide pin’s purpose is to ensure that all four cables remain in the correct pulley slots at all times. 
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Figure 1. Aileron Wing Control Cable System. 

Further investigation by BASI revealed that the two aileron control cable decals* on the 
aileron cable drum’s inboard and outboard mounting brackets at WS767 and WS780 were 
installed incorrectly. The decal for WS767 was fitted at WS780 and vice versa. BASI also found 
that a similar 747 aircraft, S/N 23028, production line number 584, had the aileron cable replaced 
because of excessive wear, and the cable was frayed down to one remaining strand. This aircraft 
also had the two aileron control cable decals on the aileron cable drum’s inboard and outboard 
mounting brackets at WS767 and WS780 fitted incorrectly and interchanged. Because of the 
decals transposition, the Safety Board requested a U.S. operator to randomly inspect its 747 
airplane aileron control systems for the aileron cable drum decal identification at WS767 and 
WS780. An inspection on November 24, 1997, of one 747-251, S/N 21707, production line 
number 378, revealed similar decal transposition on the right WS767 and WS780. 

According to Boeing, if these decals are interchanged during installation, the transposition 
results in incorrect cable routing information at the aileron cable drum and may lead to incorrect 
cable positioning during installation. A review of the applicable engineering drawings shows that 
instructions for the decal installations are correct. A check of undelivered 747s at the Boeing 
factory (production line number 1130 and onward) revealed correct decal installations. 

A BASI record review identified eight airplanes from various operators that have had 
aileron cable installation decals incorrectly installed. Boeing issued Service Letter 747-SL-27-98- 


Aileron control system decals are affixed to the airplane in strategic locations to provide illustrative and textual 
information about the type and routing of cables. 
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A on May 6, 1991, which addresses the incorrect installation of aileron control cable decals at 
WS1336.97, and suggests that the operators ensure the cables are properly installed per the 
applicable drawing. Boeing informed the Safety Board that it is planning to release a service 
bulletin (SB) to recommend that operators of 747s, produced before production line number 
1130, check their airplanes for (1) correct routing of aileron control cables on the aileron cable 
drum located at WS776.98; and (2) correct installation, and replacement as required, of aileron 
cable decals at WS767 and WS780. 

Boeing’s February 8, 1996, In-Service Activities Report 96-02-2711-10 (747) details 
cable wear occurrences to three other airplanes and attributes the cable wear to misrouting of the 
cables at the aileron cable drum. Each of the three airplanes had accumulated 40,000-50,000 
flight hours and 10,700-11,000 cycles. In each case, the cable appeared to have been chafing on 
the forward-most guide pin of the aileron cable drum as a result of cable misrouting. The data 
available regarding these incidents provides no information about whether the installation decals 
were properly located. 

The BASI investigation concluded that the Brisbane incident was caused by misrouting of 
cables on the aileron cable drum at WS776.98 and that transposition of the aileron control cable 
decals on the aileron cable drum at WS767 and WS780 has the potential to cause misalignment 
of the aileron control cables during installation. The Safety Board is concerned that airplanes 
with mispositioned aileron cable installation decals may be susceptible to aileron cable failures in 
flight, which could jeopardize flight safety. The Safety Board believes that the Federal Aviation 
Administration should issue an airworthiness directive to require operators of 747s, produced 
before production line number 1130, to conduct a one-time inspection of the aileron control 
system to ensure correct routing of aileron control cables on the aileron cable drum located at 
WS776.98 and correct installation of aileron cable decals at WS767 and WS780 at the earliest 
possible inspection interval. 

Therefore, the National Transportation Safety Board recommends that the Federal 
Aviation Administration: 

Issue an airworthiness directive to require operators of Boeing 747 airplanes, 
produced before production line number 1130, to conduct a one-time 
inspection of the aileron control system to ensure correct routing of the aileron 
control cables on the aileron cable drum located at wing station (WS)776.98 
and correct installation of aileron cable decals at WS767 and WS780 at the 
earliest possible inspection interval. (A-98-6) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA, and BLACK concurred in this recommendation. 
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On September 8, 1996, a United Airlines Boeing 737-322, N332UA, experienced what 
the flightcrew described as severe airframe vibration accompanied by feedback through the 
rudder pedals after departure from Newark International Airport, Newark, New Jersey. The 
pilots indicated to the air traffic controller that they would return to the airport and then landed 
without incident. 

While investigating this occurrence, the National Transportation Safety Board was 
informed of a previous event that had occurred on August 6, 1993. In this event, a United 
Airlines Boeing 737-300, N340UA, which had departed from LaGuardia Airport, Flushing, New 
York, encountered intermittent high amplitude vibration in the rudder pedals. The flight diverted 
to Newark, New Jersey, where it landed without incident. 

According to United Airlines, after the first event, N340UA was placed on jacks to 
simulate the flight mode. It was noted that application of the main wheel brakes caused a 
kickback or vibration in the rudder pedals. This vibration subsided when either the antiskid 
system or the “B” system hydraulics were turned off. Also, United Airlines issued an 
operational alert bulletin to its flightcrews that described the event. United Airlines has attributed 
the rudder pedal vibrations on both the August 6, 1993, and September 8, 1996, incidents to 
inadvertent activation by the pilot of the main wheel brakes while in flight. 

According to the Boeing Commercial Airplane Group, the antiskid system prevents 
skidded or blown tires on landing should the pilot inadvertently apply the brakes before 
touchdown. In the air mode, instability in the brake pedals can occur when the pedals are rapidly 
depressed, and results in an oscillation of the brake pedals and the rudder. 

This condition affects the B-737-300, 737-400, and 737-500 series airplanes. Discussions 
with Boeing revealed that although the Boeing 737 operations manual states, “...Do not apply 
brakes after becoming airborne. Braking is automatically applied when the Landing Gear Lever 
is placed in the UP position...,” there is no warning or mention of the possibility of rudder and 
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rudder pedal vibration in the FAA-approved airplane flight manual.' In addition, the operations 
manual does not mention the consequences of applying the brakes in flight or any corrective 
action necessary to stop rudder pedal vibration that could result from that action. The Safety 
Board is concerned that as long as this condition exists, it should be appropriately annotated in 
the FAA-approved airplane flight manual, along with the appropriate corrective actions defined. 
Therefore, the Safety Board believes that the FAA should require Boeing to make an addition to 
the FAA-approved airplane flight manual and abnormal procedures to state that severe vibration 
of the rudder and rudder pedals may be experienced if the main wheel brakes are applied while 
airborne and to describe corrective action necessary to terminate the vibration, for Boeing 737 
airplanes that are subject to braking system vibrations from airborne brake application. 

Therefore, the National Transportation Safety Board recommends the following to the 
Federal Aviation Administration: 

Require the Boeing Commercial Airplane Group to make an addition to the FAA- 
approved airplane flight manual and abnormal procedures to state that severe 
vibration of the rudder and rudder pedals may be experienced if the main wheel 
brakes are applied while airborne and to describe corrective action necessary to 
terminate the vibration, for Boeing 737 airplanes that are subject to braking 
system vibrations from airborne brake application. (A-98-7) 

Chairman HALL and Members HAMMERSCHMIDT and BLACK concurred in this 
recommendation. Vice Chairman FRANCIS and Member GOGLIA did not concur. 


By: 



lairman 


On some other airplanes it is common practice to apply the brakes shortly after takeoff to stop the main landing 
gear wheels from spinning in the wheel wells after gear retraction. This action prevents wheel vibration as the 
wheels spin down to a stop. 
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On April 23, 1996, a Delta Air Lines McDonnell Douglas MD-88 airplane, N985DL, 
operating as flight 1593, experienced an uncontained low pressure turbine (LPT) failure 1 in the 
No. 2 (right) engine during a regularly scheduled Title 14 Code of Federal Regulations (CFR) 
Part 121 passenger flight from Washington, D.C., to Atlanta, Georgia. The flightcrew reported 
that while cruising at flight level (FL) 310, they heard a “loud bang” from the No. 2 engine, a 
Pratt & Whitney (P&W) JT8D-219, serial number (SN) 725978. The engine lost power, followed 
by a loss of oil pressure and quantity. The pilot shut down the engine, declared an emergency, 
and diverted to the Raleigh-Durham International Airport without further incident. 

Inspection of the aircraft revealed a 3-foot by 1-foot hole in the upper cowling of the 
No. 2 engine nacelle with no other noted aircraft damage. Examination of the engine revealed 
that the bolts securing the rear turbine case rear flange to the turbine exhaust case (TEC) front 
flange had fractured, allowing the two flanges to separate, creating an opening approximately 
1-inch wide. Considerable impact damage was observed on the inner diameter of both cases; 
however, neither case was penetrated. The 4 th stage blades exited the engine through the opening 
between the cases before damaging the engine cowling. 

Examination of the LPT revealed that all the 4 th stage turbine blades, part number (PN) 
798404, were fractured transversely across the airfoil just above the blade root platform, and that 
the blade roots were retained in the disk. Metallurgical examination of one blade root revealed 
high cycle fatigue (HCF) 2 that initiated on the convex airfoil side and propagated from 75 to 80 
percent through the airfoil before failing in overload. No defects were observed in the fracture 


1 This is the only documented case of an uncontained low pressure turbine blade event occurring in a JT8D-200 
engine. 

2 HCF is the mechanism in which cracks propagate an incremental amount from the bending stresses associated 
with resonant frequency vibration. The vibration can cause rapid crack progression through a component. The 
failure can occur under normal operational stress after the crack progresses through sufficient cross section of the 
component. 
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origin area. Examination of the 4 th stage LPT blade shroud notches 3 that were recovered from the 
exhaust case revealed evidence of extreme notch wear estimated at 0.030 to 0.050 inch in depth. 

In response to reports of numerous rear turbine case/TEC attachment bolts fracturing 
during LPT blade fracture events, P&W issued Service Bulletin (SB) 6149 on January 19, 1994, 
to provide bolts made of a stronger material. The original bolts, made of Tinidur, a steel alloy, 
lacked the strength peeded to prevent the flanges from separating during an LPT blade failure' 
The stronger bolt, made of Inconel 718, a nickel alloy, improves the containment capability of the 
flange. Tinidur bolts were involved in this event. 

Two days after this event, on April 25, 1996, another Delta Air Lines, McDonnell Douglas 
MD-88 airplane, N959DL, operating as flight 591, experienced a contained No. 1 (left) engine 
LPT failure while climbing from FL 310 to FL 330. The flightcrew reported hearing a “loud 
bang” from the No. 1 engine, a P&W JT8D-219, SN 725977. The pilot shut down the engine and 
diverted to Shreveport, Louisiana, where the landing was uneventful and no injuries occurred. 

Examination of the LPT revealed that all of the 3"* and 4 th stage turbine blades were 
fractured transversely across the airfoil just above the blade root platform. As in the first incident, 
metallurgical examination of a 4 th stage LPT blade, PN 798404, revealed HCF cracking that 
originated on the airfoil convex side. No defects were noted at the fatigue origin. No evidence of 
fatigue was observed on the 3 rd stage LPT blades, nor were any 3 rd or 4 th stage blade shrouds 
recovered to determine the extent of the shroud notch wear. 

Along with the HCF on the 4 th stage LPT blades, there were other similarities to indicate a 
connection between the two events and possible causes. The engine serial numbers were 
consecutive (725977 and 725978); both engines had approximately the same number of cycles 
(10,833 and 10,862) at the time of failure; both LPT modules were essentially in the same 
condition as when they were delivered from P&W, with no repairs performed to the internal 
components; and both 4 th stage LPT blades were PN 789404, which has a thin shroud notch 
configuration. 

The JT8D LPT blade design incorporates a blade tip shroud for structural support and 
vibration dampening. The blade shrouds interlock to provide stiffness so that they function as a 
single ring to reduce blade flexing caused by thermal, aerodynamic and centrifugal loads. The 
shroud notches (contact areas) are coated with PWA 694, which is a cobalt alloy that is a hard 
temperature and wear resistant material, to help reduce wearing. Worn shroud notch surfaces 
reduce blade damping and drop the blades’ resonance frequency into the engine operating range. 
This increases the vibratory stresses to levels that can initiate fatigue cracking. 


3 The blade is a casting. The shroud is an integral part of the blade and it is located outboard on the airfoil. 




Shroud Notch (contact area) 



Shroud Notch (contact area) 

Typical Top View of Blade 


According to P&W, the JT8D-200 series engine has experienced 180 3 rd and 4 th stage LPT 
blade failures resulting from two different failure modes. The first is excessively worn LPT blade 
notches that can result in HCF fractures occurring at the root of the 3 rd and 4 stage blades. 
P&W indicated that approximately 95 percent of all 3 rd and 4 th stage blade failures are the result of 


4 


worn shroud notches. The second is a low cycle fatigue (LCF) 4 crack initiating in the 4 th stage 
blade shroud fillet resulting in a cross-notch failure. 

P&W addressed the wear problem by increasing the blade’s shroud notch contact area. 
The objective was to reduce the notch wear rate and thereby reduce blade failures. Three SBs 
were issued to introduce new 3 rd and 4 th stage LPT blade designs. SB 5867 5 was issued on 
September 22, 1989, to replace the 3 rd stage thin shroud notch blade configuration with a blade 
featuring an increased contact area. There have been only two documented 3 rd stage LPT blade 
failures of this new blade. SBs 6029 6 and 6090 7 were issued on June 18, 1991, and August 6, 
1992, respectively, to introduce 4 th stage blades with a similar larger contact area. There have 
been 18 recorded blade failures since the introduction of the two new blades. At a briefing 
conducted for the FAA and the Safety Board on October 11, 1997, P&W stated that the increased 
failure rate is due to the addition of more shroud material used for the thick notch. This extra 
material increased the LCF stresses in the shroud fillet radius resulting in thick notch shroud 
failures. The blade design was upgraded to reduce the fillet radius stresses so that the shrouds 
would no longer fracture, but kept the thick notch configuration to address the fractures due to 
excessive notch wear. P&W issued SB JT8D-6308 on October 10, 1997, to introduce this 
upgraded 4 th stage LPT blade and made it available to the operators in early November 1997. 
Thus far, there is not yet any operational experience with this current design. 

On March 7, 1996, an American Airlines McDonnell Douglas MD-82 airplane, N73444, 
operating as flight 1853, experienced a contained No. 2 engine failure en route to Orlando’ 
Florida. The flightcrew reported hearing a “loud bang” and experienced a subsequent loss of 
power in the No. 2 engine, a P&W JT8D-217C, SN 718479. The airplane returned to Chicago, 
Illinois, without further incident. Engine disassembly revealed that all of the 3 rd and 4 th stage LPT 
blades were fractured near the airfoil root. The engine was equipped with the 4 th stage LPT 
blade, PN 808904, that was introduced by SB 6090. The increased blade shroud notch surface on 
this blade was designed to have eliminated the HCF fractures at the blade root platform that 
occurred in this event. 

From 1973 through 1989, there were 527® documented cases of 3 rd and 4 th stage LPT 
blade HCF fractures occurring in JT8D-1 through -17AR series engines. 9 The LPT blade failures 

LCF is the mechanism in which cracks propagate an incremental amount from the incr ea sed pressure, 
temperature, and centrifugal stresses associated with starting an engine and increasing the thrust to takeo ff power. 

SB 5867 replaced blade PN 772203 with PN 804303. The change is applicable to -209, -217 and -217A series. 
There have been 88 documented LPT blade, PN 772203, fractures. This accounted for 85 percent of all 3 rd stage 
-200 blade failures. Approximately 65 percent of the current -200 series engine fleet has PN 804303 blades 
installed. 

6 SB 6029 replaced blade PN 775404 with PN 804304. The change is applicable to -209, -217 and -217A series 
There have been 32 documented LPT blade, PN 775404, fractures. This accounted for 31 percent of all 4 th stage 
-200 series blade failures. Approximately 72 percent of the current -200 series engine fleet has PN 804304 blades 
installed, 

7 SB 6090 replaced or modified PNs 798404 and 810504 with PN 808904. The change is applicable to -217C and 
-219 series engines. There have been 27 documented LPT blade, PN 798404, fractures. This accounted for 26 
percent of all the 4 th stage -200 series blade failures. Approximately 75 percent of the current -200 series engine 
fleet has PN 808904 blades installed. 

* T,lis * s t,ie number of documented blade failures at the time of the issuance of ASB A5913 on April 2, 1990 
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were caused by excessively worn shrouds resulting in 21 uncontained turbine events. To manage 
the problem, P&W issued an alert service bulletin (ASB), A5913, on April 2, 1990, to perform 
recurrent inspections for wear on the blade notches for installed 3 rd and 4 stage LPT blades. The 
FAA mandated this action with the issuance of Airworthiness Directives (AD) 94-20-08 and 94- 
20-09, on November 14, 1994. The inspection uses a mechanical tool made up of a torque 
screwdriver and notch gauge. The tool is inserted through the exhaust duct and placed between 
two adjacent 3 rd or 4 th stage LPT blades. The tool is then rotated to separate the blades, and the 
amount of torque to do so is recorded. This gives an indication of the amount of wear present on 
the blade notches. Blades that have worn shrouds require less torque to separate and vice versa. 
Analysis of the torque check data indicated that the inspection was effective in identifying worn 
notches before blade failures in JT8D-1 through -17AR series engines. 

P&W determined that the same failure mechanism that had occurred in the JT8D-1 
through -17AR series was also occurring in the -200 series. Based on the success of the torque 
check on -1 through -17AR series engines, P&W issued SB 6224 on October 12, 1995, to 
address the -200 series engines just as ASB A5913 had for the -1 through -17AR series. 
However, because of differences in blade geometry and operating environment for the -200 series 
engines, the inspection interval and torque limits were varied. The notch gauges were redesigned, 
and the number of inspection locations within the 3 rd and 4 th stage LPT were modified. P&W 
recommended that the time intervals listed in SB 6224 not be considered hard requirements 
because the times were based on limited service data and those operators, who had established 
inspection intervals based on their own experience, are continuing to use their own criteria until 
operational data results in revised limits. Thus far, there is no information available from the 
operators that verifies whether the torque check on the -200 series is effective and the proposed 
inspection interval is appropriate. 

Several operators, including American Airlines, Trans World Airlines and Continental 
Airlines, are using an isotope inspection (x-ray) to determine the amount of wear on the blade 
shrouds, instead of the torque check. From the x-ray, the blade offset and shroud gap are 
measured to determine the notch wear. P&W is currently reviewing this technique and the 
operators’ proposed limits, and is collecting data to determine the inspection’s effectiveness. 
Other operators are using shims to measure the gap between blades and to define acceptable wear 
limits. Each of the techniques mentioned may be effective, but the torque check remains the only 
P&W-approved procedure for determining the amount of blade notch wear. The lack of 
operational data on any of these inspection techniques makes determining the appropriate 
method(s) for measuring the wear difficult. 

Worn LPT blade shrouds can result in blade failures causing considerable engine and 
aircraft damage on JT8D-200 series engines even with the incorporation of the redesigned blades 
with the thicker shroud notch. The Safety Board concludes that recurrent inspection of the 3 rd 
and 4 th stage LPT blades for notch wear is needed to prevent future failures. Therefore, the 
Safety Board believes that the FAA should determine the effectiveness of inspection techniques 
used to measure the amount of shroud wear on installed 3 rd and 4 th stage low pressure turbine 


9 Of the 527 LPT events, 456 were 3 rd stage and the remaining 71 were 4* stage. Thirteen of the uncontained 
events were 3 rd stage LPT failures with the remaining 8 4 th stage. 
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blades on P&W JT8D-200 series turbofan engines, and mandate inspection techniques determined 
to be most effective based on an interval derived from failure and operational data. 

Therefore, the National Transportation Safety Board recommends that the Federal 
Aviation Administration: 

Determine the effectiveness of inspection techniques used to measure the amount of 
shroud wear on installed 3 rd and 4 th stage low pressure turbine blades on Pratt & Whitney 
JT8D-200 series turbofan engines, and mandate inspection techniques determined to be 
most effective based on an interval derived from failure and operational data. (A-98-8) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA, and BLACK concurred in this recommendation. 
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On July 6, 1996, at 1424 central daylight time, a McDonnell Douglas MD-88, N927DA, 
operated by Delta Air Lines Inc., as flight 1288, experienced an engine failure during the initial 
part of its takeoff roll on runway 17 at Pensacola Regional Airport (PNS) in Pensacola, Florida. 
Uncontained engine debris from the front compressor front hub (fan hub) of the No. 1 (left) 
engine penetrated the left aft fuselage. Two passengers were killed, and two others were seriously 
injured. The takeoff was rejected, and the airplane was stopped on the runway. The airplane, 
operated by Delta as a scheduled domestic passenger flight under provisions of Title 14 Code of 
Federal Regulations (CFR) Part 121, with 137 passengers and 5 crew on board, was destined for 
Hartsfield Atlanta International Airport in Atlanta, Georgia. The JT8D-219 engine was 
manufactured by Pratt & Whitney. The fan hub was machined, finished, and inspected for Pratt 
& Whitney by Volvo Aero Corporation in Trollhattan, Sweden, in January 1989. It had 
accumulated 13,835 cycles at the time of the accident. The service life, or “safe life,” of this fan 
hub was 20,000 cycles. 

The National Transportation Safety Board determined that the probable cause of this 
accident was the fracture of the left engine’s front compressor fan hub, which resulted from the 
failure of Delta Air Lines’ fluorescent penetrant inspection (FPI) 1 process to detect a detectable 
fatigue crack initiating from an area of altered microstructure that was created during the drilling 
process by Volvo for Pratt & Whitney and that went undetected at the time of manufacture. 


'FPI is an inspection technique for checking part and component surfaces for cracks or anomalies. The 
technique involves applying a penetrant fluid (a low viscosity penetrating oil containing fluorescent dyes) to the 
surface after the part has been cleaned and allowing it to penetrate into any surface cracks. Excess penetrant is then 
removed and a “developer” is applied to act as a blotter and draw the penetrant back out of any surface cracks. This 
produces a fluorescent indication of cracks or anomalies when viewed under ultraviolet lighting. 
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Contributing to the accident was the lack of sufficient redundancy in the in-service inspection 
program. 2 

Fan Hub Fracture 

The investigation revealed that the left engine fan hub fractured radially in two places 
within a tierod hole early in the takeoff roll when the airplane was at low speed during normal 
operation. Metallurgical examination of the microstructure underlying the surface of the tierod 
hole (closest to the hole wall surface) in the origin areas determined that the material was 
severely deformed and hard. The appearance of the microstructure suggested high frictional heat. 
Laboratory analysis indicated that the microstructure contained an oxygen-stabilized layer of 
recrystallized alpha grains 4 adjacent to the surface of the tierod hole. This indicated that the 
temperature at the surface of the hole in the damaged area had reached at least 1,200°F, the 
minimum recrystallization temperature for titanium. Iron was also found in this layer of altered 
microstructure, both widely dispersed and in a high concentration within small isolated bands. 

Although stabilized alpha is often associated with an inclusion in the titanium alloy 
created during the melting or forging process, it can also be formed during machining operations 
when tools overheat titanium alloy in the presence of air. The location and appearance of the 
accident hub’s altered microstructure indicated that the deformation was formed by a tool used in 
creating the tierod hole. 

Volvo test drillings conducted after the accident produced altered microstructure in two 
holes, one of which contained features very similar to the accident hub. Test drilling was 
conducted using a coolant channel drill, 5 but without coolant and at higher drill revolution and 
feed speeds to promote tool (drill) breakage and the accumulation of chips in the hole. 
According to Volvo’s report, altered microstructure “can be created during rough [initial] 
drilling, but not during subsequent boring and honing operations.” 

According to Volvo, the hole with defect features that most resembled those of the 
accident hub had a microstructure that was “heavily deformed” and that had a hardness that 
corresponded with the values for the failed hub.” An analysis determined that the layer of 


2 

National Transportation Safety Board. 1998. Uncontained Engine Failure, Delta Air Lines Flight 1288, 
McDonnell Douglas MD-88, N927DA, Pensacola, Florida July 6, 1996. Aircraft Accident Report NTSB/ 
AAR-98-01. Washington, DC. 
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The aft end of the fan hub attached to the stage 1.5 disk with 24 tierods that passed through tierod holes 
drilled in the hub rim. 

4 

Recrystallization is a formation of a new grain structure from the structure of the deformed metal. 

5 A coolant channel drill has two internal borings that bring coolant/lubricant to the tip of the drill just 
behind the cutting lips. 
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deformed microstructure contained ladder type cracking and “a high concentration of iron from 
the drilling operation.” 6 

Because the high temperature (at least 1,200°F) required to form the altered 
microstructure could not have existed if coolant were flowing freely over the area, the Safety 
Board considered the possibility that the coolant channel drill malfunctioned. However, because 
a complete cessation of coolant flow over the hub would have been readily noticeable by the drill 
operator, the loss of coolant to the area of the altered microstructure was more likely caused by a 
brief obstruction to the coolant reaching that particular area, such as would result from chip 
packing or broken pieces of a drill bit. Therefore, chip packing or wedging, leading to a 
temporary, localized loss of coolant most likely contributed to the creation of the altered 
microstructure. Thus, the Safety Board concludes that some form of drill breakage or drill 
breakdown, combined with localized loss of coolant and chip packing, occurred during the 
drilling process, creating the altered microstructure and ladder cracking in the accident hub. 
Based on the number of fatigue striations found in the fatigue fracture region, which was roughly 
equivalent to the number of the hub’s flight cycles, the Safety Board further concludes that the 
fatigue cracks initiated from the ladder cracking in the tierod hole and began propagating almost 
immediately after the hub was put into service in 1990. 

Analysis of Volvo’s Inspection Procedures 

A blue etch anodize (BEA) 7 test conducted by the Safety Board on the sectioned accident 
hub revealed a dark blue indication in the areas of the altered microstructure. However, the 
accident hub passed BEA and visual inspections at Volvo following the drilling process that 
created the anomalous microstructure. Although the BEA inspector at Volvo noted on a shop 
traveler 8 that he observed “manufacturing marks” inside a hole, at a subsequent visual inspection 
inspectors determined that all the holes conformed to Pratt & Whitney acceptance criteria for 
surface finish on bolt holes. Postaccident metallurgical analysis confirmed that the surface finish 
in those areas of the tierod hole was consistent with the surface finish requirements specified by 
Pratt & Whitney. The Safety Board’s examination determined that there was no evidence of 
excessive machining marks at the surface of the hole. It could not be determined whether the 
BEA inspector made the notation of “manufacturing marks” because of the different surface 
finish in the tierod hole (boring marks surrounded by honing marks), because of a different 
coloration resulting from the BEA inspection process, or for some other reason. 


6 Drill breakdown, for example, could cause minute parts of the drill to shear off during the drilling process. 

7 The BEA inspection process is unique to titanium and involves a visual inspection of the surface after it is 
anodized (the part surface is electro-chemically oxidized) for anomalies associated with microstructure changes in 
the metal. 

8 A shop traveler is a process sheet or record that documents inspections or tasks performed on a 
component. 
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The Volvo manager who testified during the Safety Board’s public hearing stated that the 
notation by the BEA inspector of “manufacturing marks” in the hole did not signify that the 
inspector had observed a BEA discrepancy based on the BEA defect templates in use at the time, 
and he stated that this notation was only intended to alert inspectors conducting subsequent 
visual inspections with different inspection criteria. Thus, the Safety Board concludes that 
although the altered microstructure in the accident hub tierod hole was detectable by BEA 
inspection methods, Volvo did not identify it as rejectable because the appearance of the tierod 
hole did not match any of the existing inspection templates showing rejectable conditions. 

The failure of the manufacturer’s BEA inspection to detect and identify a rejectable 
condition in the accident hub after the drilling process at Volvo resulted in the postaccident 
development of and addition of four new templates to assist in identifying microstructural defects 
similar to the accident hub for use by BEA inspectors. The Safety Board recognizes that the 
BEA inspection process places interpretive demands on inspectors, that identification of 
rejectable conditions may still not be complete, and that templates of defect indications are added 
when they are encountered and identified. The Safety Board concludes that although the 
additional templates will assist BEA inspectors in detecting potential defects similar to the one 
that existed on the accident hub, this accident suggests that there may be additional rejectable 
conditions that have not yet been identified. The Safety Board is concerned that these problems 
may not be unique to parts manufactured by Pratt & Whitney. Therefore, the Safety Board 
believes that the FAA should form a task force to evaluate the limitations of the BEA and other 
postmanufacturing etch processes and develop ways to improve the likelihood that abnormal 
microstructure will be detected. In so doing, it may be appropriate to consider whether any part 
of these processes can be automated, so as to minimize the possibility of human error. 

When Pratt & Whitney approved Volvo’s request to use a coolant channel drill, this 
change was approved because Pratt & Whitney’s engineering data indicated that changes in 
drilling operations were “insignificant” as long as subsequent boring and honing operations were 
carried out to a depth of at least .010 inch to remove material (including defects) created by the 
drilling phase. The total depth of material removed from the tierod hole after drilling on the 
accident hub was about .0185 inch. Metallurgical examinations conducted by the Safety Board 
after the accident indicated that the total depth of the altered microstructure created by the drill 
was about .024 inch, more than twice the depth anticipated by the .010-inch limit set by Pratt & 
Whitney. The Safety Board concludes that drilling damage in this accident hub extended much 
deeper into hole sidewall material than the depth previously anticipated by Pratt & Whitney. 
Thus, the Safety Board believes that the FAA should inform all manufacturers of titanium 
rotating engine components of the potential that current boring and honing specifications may not 
be sufficient to remove potential defects from holes and ask them to reevaluate their 
manufacturing specifications and procedures with this in mind. 

Failure of Delta Maintenance to Detect Cracking in the Accident Hub 

On October 27, 1995, Delta’s maintenance facility in Atlanta, Georgia, performed an FPI 
on the accident hub. This inspection, conducted 1,142 cycles before the accident, was part of 
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overhaul work recommended in Pratt & Whitney’s engine shop manual for hubs disassembled 
from engines before reaching their “safe life” limits. 

Postaccident metallurgical examinations conducted by the Safety Board indicated that 
based on the striation count, at the time of the last FPI, the crack on the aft hub surface adjacent 
to the tierod hole was about 0.46 inch long and that this crack extended about 0.90 inch within 
the tierod hole, for a total surface length of 1.36 inches. The FAA’s review of FPI processes at 
Delta concluded that based on reliability data collected by the Nondestructive Testing 
Information Analysis Center (NTIAC), a visible crack of this size should have been detectable 
with both a probability of detection and confidence level exceeding 95 percent. The crack was 
well above the minimum detection length of 0.10 inch as calculated by the NTIAC’s 
Nondestructive Evaluation Capabilities Data Book, 9 and the 0.08-inch and 0.10-inch range 
suggested in the FAA’s December 14, 1990, Titanium Rotating Components Review Team 
(TRCRT) report. Therefore, the Safety Board concludes that the crack was large enough to have 
been detectable during the accident hub’s last FPI at Delta. 

The Safety Board considered the possibility that the crack was not visible during the FPI 
at Delta. The Safety Board’s investigation found that there are a number of ways in which the 
effectiveness of the FPI process could have been compromised by improperly performed or 
inadequate procedures. The Safety Board also considered the possibility that the crack was 
visible at the time of the FPI, but that the FPI inspector either overlooked it or discounted it as 
insignificant. 

Part Cleaning, Drying, Processing, and Handling 

The FAA’s postaccident report of an August 1996 inspection of the FPI process used by 
Delta indicated that there was no assurance that parts received by FPI operators were “clean 
enough for an adequate FPI.” The FAA report also noted that cleaning personnel were not made 
aware of the “criticality of the engine components and the end purpose for which these 
components were being cleaned.” The inspector who inspected the accident hub indicated that 
he frequently had to send parts back for additional cleaning. The Safety Board recognizes that 
following the FAA’s technical review of Delta’s FPI process, Delta indicated that it was 
providing cleaning personnel with training to emphasize different cleaning procedures for critical 
parts, especially those being prepared for FPI, and that it was working with engine manufacturers 
to develop cleaning standards for specific parts. However, the Safety Board is concerned that 
similar shortcomings may exist at other maintenance facilities performing FPIs. 

At the conclusion of the cleaning process in preparation for an FPI at Delta, parts were 
immersed in a “hot water rinse” and flash dried. Because the dye penetrant applied later in the 
process has an oil base, any water remaining in cracks would block entry of the dye into those 
areas. For the flash drying process to be effective, the part must be heated to the temperature of 
the water, which must be kept at a temperature of between 150° and 200°F, according to Pratt & 


9 

See ‘‘Nondestructive Evaluation Capabilities Data Book,” Published by the NTIAC, Texas Research 
Institute Austin, Inc. DB-95-02, May 1996. 
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Whitney’s Overhaul Standard Practices Manual (OSPM) and Delta’s Process Standard. A 
temperature measuring device was not used to determine whether parts had reached the 
temperature of the water. Rather, according to a Delta representative, operators determined that 
parts had reached the proper temperature by “feel” and that the water temperature was checked 
on a weekly basis. After the accident and the FAA inspection. Delta implemented changes 
requiring more frequent checks of the water temperature. 

Delta’s director of compliance and quality assurance testified at the public hearing that 
flash drying may not be effective in areas where water is trapped in areas “that you can’t readily 
see or flaws....” A representative of a company that produces FPI hardware and chemicals 
testified that “it’s absolutely imperative that the parts come to the process clean and dry.” 
Another witness from a company that provided Delta with chemicals for the FPI process stated 
that the effectiveness of flash drying depends on the depth of the crack. “If it’s a fairly deep 
crack...it’s doubtful whether you’re going to remove that [water] from a fatigue crack,” the 
chemical company witness stated. Although it could not be conclusively determined whether 
water trapped in the crack at the time of the FPI rendered the crack undetectable by this method, 
the Safety Board is concerned that a number of experienced practitioners in the field believe that 
such a potential exists when flash drying is the only drying method used. The Safety Board 
concludes that significant questions exist about the reliability of flash drying in removing water 
from cracks. 

With regard to the processing of parts after drying, specifically, the application of 
developer powder, the Safety Board is concerned that when only a spray gun applicator was used, 
the powder did not cover the hole walls along the full depth of the hole. The Safety Board is 
further concerned that even using a more focused application tool, such as a squeeze bulb, the 
geometry of the hub may be such that full coverage of hole walls may never be possible. 
Although in this case that deficiency would not have prevented detection of the crack (because 
there was also a sizable crack on the aft face of the hub), under other circumstances this 
incomplete coverage may result in nondetection of an otherwise detectable crack. Therefore, the 
Safety Board concludes that better techniques are needed to ensure the fullest possible coverage 
of dry developer powder, particularly along hole walls. 

Safety Board observers also found that Delta had no formal logging procedure to identify 
parts ready for inspection (inspection must occur within 2 hours of the application of the 
developer powder and indications found after 1 hour are considered questionable). Delta 
representatives indicated that shop personnel relied on a “group knowledge” of how long a part 
had been ready for inspection. 

The time between application of the developer and inspection must be controlled to 
maximize the brilliance of indications (which increases over time), yet ensure that sufficient dye 
penetrant remains in the defect for diagnostic activities. Delta inspectors described a method for 
part tracking in which they coordinated with processors to control the flow of parts so that the 
time limit would not be exceeded. This informal system would have been vulnerable to error 
from the difficulty of estimating how long an inspection of the part will take inside the booth, 
worker distraction, and the potential for the loss of collective knowledge during shift turnover. 
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Thus, it could not have been possible for Delta personnel to consistently adhere to the 
development time requirements using this system or to know exactly how long a part had been 
ready for inspection. The Safety Board is concerned that Delta had timing requirements in its 
process standard but failed to provide its personnel with a way to adhere to them. Thus, there is 
no assurance that the accident hub was inspected within the limits set forth in the process 
standard. Although it could not be conclusively determined whether this played a role in the 
nondetection of the crack in the accident hub, the Safety Board concludes that the absence of a 
system that formally tracks the timing of the movement of parts through the FPI process was a 
significant deficiency. The Safety Board notes that after the accident, Delta implemented a 
procedure to record part development times on a status board that formalizes part tracking and 
adherence to time requirements. However, the Safety Board is concerned that other operators 
and repair stations may not have adequate methods to positively identify the status of parts 
processed for FPIs. 

During the FPI process at Delta, hubs are placed aft-side down on a plastic disk to keep 
them from contacting the rollers on the FPI line during inspection. Processors and inspectors 
used their hands to lift and turn the hub on the plastic disk to gain access to the aft-side and 
interior. During these lifting actions, it would have been difficult for personnel to ensure that 
they were not touching the hub in an area with an indication, particularly on the aft-face. FPI 
experts testified at the public hearing that penetrant could be rubbed off during handling. If 
penetrant was prevented (by dirt or water) from fully entering the crack, then rubbing off the 
surface penetrant would probably have removed any indication of the crack. But even if 
penetrant was in the crack, loss or distortion of penetrant at the surface could have resulted in an 
ill-defined indication, thus making the crack more difficult to detect. Although the extent to 
which it contributed to the nondetection of the crack could not be determined, the manual 
handling of the hub at Delta during the processing and inspection of the accident hub increased 
the opportunity for smearing of an indication on the aft-face. The Safety Board notes that after 
the accident. Delta advised its FPI personnel to minimize manual handling of hubs and to use 
support equipment, such as an overhead hoist, in the inspection booth. 

The Safety Board previously addressed manual handling and methods to support parts 
during FPI following a July 19, 1989, accident at Sioux City, Iowa, involving a United Airlines 
DC-10-10 airplane. That accident was also caused by a crack in a critical rotating engine part. 10 
The Safety Board report on that accident stated 

It is possible that the inspector...did not rotate the disk, as it was suspended by a 
cable, to enable both proper preparation and subsequent viewing of all portions of 
the disk bore, particularly the area hidden by the suspension cable/hose. 

The Safety Board is concerned that deficiencies in the methods for handling critical 
rotating parts during FPI have been identified in this accident and in the United Airlines accident 


'°National Transportation Safety Board. 1990. United Airlines Flight 232, McDonnell Douglas DC-10-10, 
Sioux City Gateway Airport, Sioux City, Iowa, July 19, 1989. Aircraft Accident Report NTSB/AAR-90/06. 
Washington, DC. 
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in Sioux City, Iowa. The Safety Board concludes that FPI indications remain vulnerable to 
manual handling, and fixtures used to support the part during inspection may obstruct inspector 
access to areas of the part. 

Further, the Safety Board concludes that one or more procedural deficiencies in the 
cleaning, drying, processing, and handling of the part might have reduced or prevented the 
effectiveness of Delta’s FPI process in revealing the crack. The Safety Board also concludes that 
the potential deficiencies identified in the Delta FPI process may exist at other maintenance 
facilities and be, in part, the reason for the failure to detect cracks in other failed engines 
identified in this investigation. Therefore, the Safety Board believes that the FAA should 
establish and require adherence to a uniform set of standards for materials and procedures used in 
the cleaning, drying, processing, and handling of parts in the FPI process. In establishing those 
standards, the FAA should do the following: 

1. Review the efficacy of drying procedures for aqueously cleaned 
rotating engine parts being prepared for FPIs; 

2. Determine whether flash drying alone is a sufficiently reliable method; 

3. Address the need to ensure the fullest possible coverage of dry 
developer powder, particularly along hole walls; 

4. Address the need for a formal system to track and control development 
times; and 

5. Address the need for fixtures that minimize manual handling of the 
part without visually masking large surfaces of the part. 

Lack of a Formal Method to Ensure Completeness of Search and Diagnostic Followup 

To detect the crack on the aft-face of the hub, the inspector would have had to first detect 
a bright fluorescent green indication (if there was such an indication) against a dark purple 
background." To detect the indication, the inspector would have had to systematically direct his 
gaze across all surfaces of the hub. However, systematic visual search is difficult and vulnerable 
to human error. Research on visual inspection of airframe components, for example, has 
demonstrated that cracks above the threshold for detection are missed at times by inspectors 
because they fail to scan an area of a component. 12 Delta FPI inspectors described inspecting 
major areas on the -219 hub in the same order each time. Although this technique was variable 
among inspectors and vulnerable to omission, it would help ensure that major areas of the hub 
were not missed. However, it is possible that the inspector examined the aft-face of the hub but 
did not look at the specific area containing the indication near the tierod hole. 


The brilliance of an indication is affected by the crack size and amount of penetrant in the defect. Dye 
penetrant contamination in the work area, processing errors, and methods used to handle and move hubs during the 
FPI process can also decrease the brilliance of an indication and can affect the inspector’s ability to detect a crack. 

12 

Department of Transportation. 1996. Visual Inspection Research Project Report on Benchmark 
Inspections. Final Report, October 1996. DOT/FAA/AR-96/95. Washington, DC. This research group advocated 
development of NDI reliability models that acknowledge a background miss rate unrelated to crack length to more 
accurately model the observed data. 



9 


Interruption is an inherent part of the FPI process, and the inspector would have 
interrupted his visual search several times to conduct diagnostic evaluations on detected 
indications and to reposition the hub. It is possible that the inspector failed to resume his search 
at the last location examined and that he was not aware of this because of the size and complexity 
of the part. 13 In studies of airframe inspectors, some have failed to detect defects because they 
did not resume their inspection at the appropriate location after stopping to move equipment. 

It is also possible that the inspector detected an indication at the location of the crack but 
forgot to diagnose, or reinspect, the location. If inspectors had a method to document examined 
areas and locations requiring followup diagnosis, the inspector’s dependency on memory would 
be reduced. A system in which an inspector could insert plastic markers into holes that have 
been inspected and found to be defect-free would serve as a mechanical checklist for the 
inspector and document the progress of the inspection across the part. Such a system would also 
reduce the opportunity for human error in other procedural inspections, such as eddy current 

inspections 14 of rivets or holes. 

Nondestructive testing (NDT) 15 inspections of critical rotating parts for small flaws are 
vulnerable to error in visual search and are dependent on the inspector’s memory to ensure that 
an exhaustive search and adequate followup has been conducted. Accordingly, the Safety Board 
concludes that an inadvertent failure of the inspector to systematically search and complete 
followup diagnosis when necessary on all surfaces of the hub might have caused the inspector to 
overlook the crack. Therefore, the Safety Board believes that the FAA should require the 
development of methods for inspectors to note on the part or otherwise document during an NDT 
inspection the portions of a critical rotating part that have already been inspected and received 
diagnostic followup to ensure the complete inspection of the part. 

Low Expectation of Finding a Crack and Decreased Vigilance 

FPI inspectors are required to diagnose each detected indication to determine if it is a 
crack because a crack is reason to reject the part. But not every indication is a crack, and most 
preliminary indications are later found not to be cracks. The inspector who inspected the 
accident hub stated that he could not recall ever having detected a crack on a -219 hub, and the 
inspector’s supervisor stated that he was not aware that cracks had ever been found on a -219 hub 
at Delta. Therefore, the inspector’s experience diagnosing indications on -219 hubs consisted of 
a series of false indications. Although the inspector stated that he approached a part as if it had a 


13 

It is also possible that the glare associated with the use of white light to diagnose indications contributed 
to this omission because this process caused his eyes to lose dark adaptation. 

l4 Eddy current inspections measure fluctuations in an alternating magnetic field around a part generated by 
a transducer carrying an alternating current. Eddy current inspections are used to locate surface and near-surface 
defects. 

15 NDT methods are those that do not damage or significantly alter the component being tested during 


inspection. 
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crack to detect, his experience with indications on -219 hubs most likely biased his expectation 
of confirming that an indication was a crack, especially if the indication was not clearly defined. 
Therefore, the Safety Board concludes that a low expectation of finding a crack in a -219 series 
fan hub might have caused the inspector to overlook or minimize the significance of an 
indication. 

A low expectation of finding a crack might also have decreased the inspector’s vigilance. 
Further, research on vigilance suggests that performance decreases with increasing inspection 
time. However, data to support this conclusion in the aviation inspection domain are 
inconclusive. In addition, a recent study of eddy current inspection of airframe skin panels found 
no relationship between inspection duration and probability of defect detection. In any event, 
no evidence from this investigation exists to evaluate how inspection duration and the adequacy 
of breaks (the inspector stated he took frequent breaks) affected the inspection of the accident 
hub. The inspector who inspected the accident hub characterized the FPI process as tedious and 
monotonous and stated that he spent about 75 percent of his shift inspecting parts. He also stated 
that inspection of a -219 hub typically took about 40 minutes to 2 hours, depending on the 
number of indications detected. 

The Safety Board concludes that the duration of inspections and the amount and duration 
of rest periods may indeed affect inspector performance, but this potential has not been 
adequately studied in the aviation domain. Therefore, the Safety Board believes that the FAA 
should conduct research to determine the optimum amount of time an inspector can perform 
NDT inspections before human performance decrements can be expected. 

Inadequate Diagnostic Techniques or Controls 

It is also possible that the inspector detected an indication at the location of the crack but 
did not properly complete the followup diagnostic procedure. Diagnostic procedures must be 
consistently performed and the appropriate time periods must be allowed for redevelopment to 
ensure that a true defect is not allowed to pass. Delta’s Process Standard for conducting FPIs 
directed inspectors to wait at least 5 minutes to confirm that an indication had not reappeared 
after developer was applied during the bleedout procedure. As discussed above, there was no 
formal method for the inspectors to track these indications and to ensure that they were 
reinspected after the required redevelopment period. Further, no formal method was in place to 
ensure adherence to the redevelopment time period. The Safety Board anticipates that in 
establishing the uniform set of standards (recommended above), the FAA will recognize the need 
for a formal system for measuring and recording development times listed in their process 
standards for FPI. 


16 Drury, C. G. 1992. Inspection Performance , Handbook of Industrial Engineering . New York. 

^Department of Transportation. 1992. Reliability Assessment at Airline Inspection Facilities, Volume III: 
Results of an Eddy Current Inspection Reliability Experiment. May 1995. Final Report. DOT/FAA/CT-92/12, III. 
Washington, DC. 
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Adequacy of Inspector Training and Proficiency 

The Safety Board addressed the issue of NDT inspector training in a previous accident 
investigation of an uncontained engine failure. 18 In that accident, the Safety Board concluded 
that a ‘/ 2 -inch crack was present during the last inspection of the disk that would have been 
detected if proper magnetic particle inspection (MPI) methods had been applied. The Safety 
Board noted that inspectors at the engine’s repair station had trained each other and that the 
manufacturer had recommended that the repair station develop a formal initial and recurrent 
training program. In contrast, the Delta FPI inspector had completed a formal training program 
that included written and practical examinations and his training was consistent with industry 
standards. However, because this accident revealed that a crack was not detected at a repair 
facility that followed industry guidance, the Safety Board issued Safety Recommendation 
A-96-77 on July 29, 1996, asking the FA A to 

Review and revise, in conjunction with the engine manufacturers and air carriers, 
the procedures, training (including syllabi and visual aids) and supervision 
provided to inspectors for performing FPI and other nondestructive testing of 
high-energy rotating engine parts, with particular emphasis on the JT8D-200 
series tierod and stress redistribution holes. 

The Safety Board classified this recommendation “Open—Acceptable Response” in 
February 1997, pending final FA A action after the FAA stated that it had inspected Delta’s FPI 
facility and concluded that the airline “had the proper guidance for training and qualifying 
personnel” in NDT and FPI. The Safety Board’s decision was also based on FAA plans to have 
its FPI Review Team visit six FPI facilities, at a rate of two facilities per month. After the 
inspections, the FAA stated that it would issue a report and determine what course of action, if any, 
needed to be taken. The FAA stated that it would also evaluate other facilities that perform FPI 
and other NDT procedures to determine whether systemic problems existed. The FAA has 
completed these inspections, but the report has not yet been issued. 

A human factors expert testified at the public hearing on this accident that methods have 
been identified to augment training in inspection. These methods include incremental guidance 
for specific inspection skills and feedback guidance to inspectors during training. As the FAA 
completes action on A-96-77, the Safety Board anticipates that the FAA will consider these 
methods to improve inspector performance. 

After the FAA's August 1996 review of Delta’s FPI facility, the FAA recommended that 
written and proficiency examinations be required during inspector recertification. Delta 
responded to the recommendation by requiring that inspectors pass a written examination on FPI 
procedural knowledge and receive training to proficiency on a practical examination on a set of 
10 sample parts. The Safety Board agrees with the FAA that additional and more frequent 


18 

National Transportation Safety Board. 1996. Uncontained Engine Failure/Fire, ValuJet Airlines Flight 
597, Douglas DC-9-32, N908VJ, Atlanta, Georgia, June 8, 1995. Aircraft Accident Report NTSB/AAR-96/03. 
Washington, DC. 
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evaluation of inspectors is needed to ensure that inspectors are qualified to do their job. Written 
examinations provide information about an inspector's knowledge of the inspection process and 
procedures. Proficiency examinations like the one administered at Delta determine whether the 
inspector can apply the inspection procedures and interpret the results using a limited set of test 
pieces or actual parts. However, the effectiveness of an inspection involving visual search, like 
FPI, depends on the inspector's skills in visual search and detection, which cannot be adequately 
evaluated using written exams and practical tests that do not evaluate the ability of an inspector 
to detect indications using a sample of representative parts with and without defects. It would be 
beneficial to evaluate the inspector's skills to detect defects on the line, however, because defects 
that are missed on actual parts can go undetected. Important feedback information required to 
determine inspector sensitivity is not available. 

The Safety Board concludes that because of the potentially catastrophic consequences of 
a missed crack in a critical rotating part, testing methods that evaluate inspector capabilities in 
visual search and detection and document their sensitivity to detecting defects on representative 
parts are necessary. Such methods would require an inspector to examine several parts, some 
containing defects and some without, which are representative of those tested on the line. In 
addition, the defects provided should range in size from small at the threshold for the inspection 
method to large and well within the method's capabilities. A test of this type would provide an 
indication on the capabilities of the inspector unlike practical tests on only a few samples or that 
involve training to proficiency. Further, it would facilitate a comparison of how different 
inspectors perform and if administered on a frequent basis provide a way to track inspector 
performance and focus recurrent training. Therefore, the Safety Board believes that the FAA 
should, in conjunction with industry and human factors experts, develop test methods that can 
evaluate inspector skill in visual search and detection across a representative range of test pieces, 
and ensure proficiency examinations incorporate these methods and are administered during 
initial and recurrent training for inspectors working on critical rotating parts. 

Because FPI is dependent on several individuals performing multiple procedures, no 
single reason for the nondetection of the crack in this accident could be identified. The Safety 
Board concludes that Delta’s nondetection of the crack was caused either by a failure of the 
cleaning and FPI processing, a failure of the inspector to detect the crack, or some combination 
of these factors. 

Adequacy of Inspection Requirements for Critical Rotating Titanium Components 

The Safety Board issued comprehensive recommendations following the United Airlines 
accident in Sioux City, Iowa, in which an in-flight uncontained engine failure led to the loss of 
the three hydraulic systems that powered the airplane’s flight controls. The investigation found 
that fatigue cracking in the front fan disk originated in a hard alpha inclusion that had formed 
during the casting of the disk material. Included in the recommendations were Safety 
Recommendations A-90-89 and -90, which asked the FAA to develop a damage tolerance 
inspection program for all engine components that, if they failed or separated, posed a significant 
threat to the structures and systems of airplanes. In response, the FAA formed the TRCRT to 



13 


assess the quality control procedures used in the manufacture of titanium alloy high-energy 
rotating components of turbine engines. 

The TRCRT final report made several recommendations related to in-service inspections 
of titanium rotating parts, including using eddy current inspections to supplement FPIs and a 
requirement to subject such parts to at least two “subsurface inspections” (e.g., ultrasonic) 
during their cyclic life. However, the implementation schedule for recommendations contained 
in the TRCRT report was canceled by the FAA following a 1991 industry conference during 
which industry representatives requested that the schedule be modified. Based on an April 6, 
1993, FAA letter to the Safety Board that stated that future action would be taken to “develop 
implementation schedules commensurate with the needs of the FAA, industry, and the flying 
public,” the Safety Board classified both safety recommendations “Closed—Acceptable 
Alternate Action” on May 28, 1993. The Safety Board is disappointed that no new schedules 
were developed and that no further action was taken by the FAA to implement the 
recommendations in the TRCRT report. 

In addition to this accident, several other uncontained engine failures have occurred after 

the Sioux City accident and the TRCRT report because of fatigue cracking that initiated from 

various sorts of microstructural conditions created at manufacture. Further, there was also 

21 

evidence of manufacturing defects in several engines that failed before the Sioux City accident. 
This accident history demonstrates that a variety of manufacturing anomalies in a variety of 
locations on engine parts can lead to uncontained failures, and that manufacturing defects are not 
as rare as might once have been believed. Further, given the loss of life that has resulted from 
the Sioux City and Pensacola failures, it is also clear that such defects can pose a significant 
threat to safety. 

Most, if not all, of these engine parts were, at the time of manufacture, subjected to one or 
more nondestructive inspection techniques (such as an etch, ultrasonic inspection, or FPI) 
designed to detect manufacturing-related flaws and anomalies that may lead to cracking. (Some 
of the etch and ultrasonic inspections were performed on the rectilinear part [machine forged 


19 Ultrasonic testing is an NDT method in which high-frequency sound waves are introduced to materials to 
detect surface and subsurface flaws. 

2 °A 1993 failure of the HPC stage 3-9 spool in a CF6-80C2 in Los Angeles, California, was attributed to 
dwell time fatigue initiating an area of aligned alpha colonies in the titanium alloy; a 1995 failure of an Egypt Air 
CF6-50C2 engine was attributed to a crack originating at a hard alpha inclusion in stage 6 of the HPC 3-9 stage 
spool; a 1995 failure of a CF6-50C2B engine in Bangkok, Thailand, was attributed to dwell time fatigue resulting 
from aligned alpha colonies in the disc bore of the 3-9 HPC; and evidence from a 1997 failure of a Canadian Airlines 
CF6-80C2B6F engine, which is still under investigation, has revealed a microstructural anomaly in the blade slot 
bottom of the 3 rd -stage HPC 3-9 stage spool. 

21 The 1982 failure of a Pan Am JT8D-7 engine was attributed to a crack originating in altered 
microstructure in a tierod hole, and three CF6 engine failures occurring in 1974, 1979, and 1983 were attributed to 
cracking originating in hard alpha inclusions. 
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shape], and not on the final shape, a practice that is no longer being used.) However, none of 
the flaws and anomalies that existed in those parts were detected, and the parts passed inspection. 
This demonstrates that the inspection methods used at manufacture can be fallible, and that 
newly manufactured engine parts may be placed into service containing potentially dangerous 
flaws. 


Further, many of the flawed engine parts were subjected to in-service FPI or ultrasonic 
inspections after they developed cracks that had propagated to detectable lengths, yet they were 
not removed from service. 23 Thus, it is clear that detectable cracks in critical rotating engine 
parts may escape detection, even though the part has undergone in-service nondestructive testing 
techniques such as FPI. This point is further demonstrated by the ValuJet uncontained engine 
failure in Atlanta which, although it did not involve a manufacturing defect, again shows that a 
critical rotating part with a detectable crack can successfully pass through an NDT process (in 

that case magnetic particle inspection) and be placed back into service. Probability of detection 
data confirm that even assuming the FPI procedures are properly executed, some detectable 
cracks will be missed. However, because FPI procedures may not always be properly carried out, 
there are several additional reasons why a detectable crack may be missed during the FPI process. 

The Safety Board concludes that manufacturing and in-service inspection processes 
currently being used do not provide sufficient redundancy to guarantee that newly manufactured 
critical rotating titanium engine parts will be put into service defect-free and will remain crack- 
free through the service life of the part. The Safety Board agrees with the TRCRT conclusion 
that 


[based on the] frequency of occurrence of titanium metallurgical defects, the 
difficulty of detecting defects in titanium,...the many sources of defects, errors 
and damage, recent developments in the engineering science of fracture 
mechanics (crack propagation) analysis...the random approach of inspections of 
opportunity is not adequate, and can no longer be justified. 

In light of the above, the Safety Board is especially concerned that the FAA’s initial and 
recurring inspection program, as outlined in Airworthiness Directive (AD) 97-02-11 and a 
subsequent final rule addressing the intent of Safety Recommendation A-96-74 (by taking into 
account the potential for microstructural defects produced by standard drills after a “major event 
such as tool breakage”), does not include mandatory or fixed-interval repetitive inspections for 
the remaining population of 2,272 fan hubs urged in Safety Recommendation A-96-75. 


For example, the parts involved in the Sioux City, Egypt Air, and Canadian Airlines accidents were 
etched only in their rectilinear shape and were subjected to FPI in their final shape. 

23 

In addition to the fan hub involved in this accident, the parts involved in the 1989 Sioux City, 1995 Egypt 
Air, 1982 Pan Am, 1995 Thailand, and 1997 Canadian Air accidents all underwent in-service FPI. 

24 

MPI is an NDT testing method that uses part or surface magnetization to locate surface and subsurface 


effects. 
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The Safety Board is concerned that JT8D-200 series fan hubs with more than 4,000 CSN 
may not receive FPI and eddy current inspections when these fan hubs are in the shop because 
there is no requirement to disassemble hubs to the piece-part level. In addition, AD 97-02-11 
imposed no inspection requirement before retirement at 20,000 cycles in service (CIS) on fan 
hubs that have accumulated over 10,000 CIS before March 5, 1997, which constitutes a large 
percentage of all JT8D-200 series fan hubs. As such, AD 97-02-11 does not require the 
population of JT8D-200 series fan hubs with holes produced with standard drills or hubs with no 
machining or dimensional anomalies to be inspected unless the engine is disassembled to the 
piece-part level. This approach remains unacceptable. 

However, the Safety Board’s concern is not limited to JT8D-200 series fan hubs, but 
extends to all critical rotating titanium engine components. The Safety Board concludes that all 
critical rotating titanium engine components are susceptible to manufacturing flaws and resulting 
cracking and uncontained engine failures that could potentially lead to catastrophic accidents. 
Therefore, the Safety Board believes that the FAA should require that all heavy rotating titanium 
engine components (including the JT8D-200 series fan hubs) receive appropriate NDT 
inspections (multiple inspections, if needed) based on probability of detection data at intervals in 
the component’s service life, such that if a crack exists, but is not detected during the first 
inspection, it will receive a second inspection before it can propagate to failure. In developing 
the inspection intervals, the Safety Board urges the FAA to assume that a crack may begin to 
propagate immediately after being put into service, as occurred in this accident and the United 
Airlines accident at Sioux City. 

The Safety Board recognizes that all necessary probability of detection data and crack 
propagation rates may not be immediately available, and may have to be developed for some 
components. Therefore, the Safety Board believes that the FAA should require, as an interim 
measure, pending implementation of Safety Recommendation A-98-19, that critical rotating 
titanium engine components that have been in service for at least 2 years receive an FPI, eddy 
current, and ultrasonic inspection of the high-stress areas at the engine’s next shop visit or within 
2 years from the date of this recommendation, whichever occurs first. 

These recommendations supersede Safety Recommendations A-96-74 and A-96-75, 
which the Safety Board now classifies “Closed—Unacceptable Action/Superseded.” 

Maintenance Deficiencies 

During the preflight inspection the first officer found a small amount of oil on the bullet 
nose of the left engine and two rivets missing from the left wing. The oil that was found on the 
bullet nose could not have been related to the hub failure, and the missing rivets were from an 
outboard section of the wing. Therefore, the Safety Board concludes that these were not factors 
in the subsequent engine failure. 

However, the Safety Board is concerned that the flightcrew did not request maintenance 
action before departure from Pensacola and that flightcrews may generally be reluctant to request 
maintenance at airports without company maintenance facilities because the reporting process 
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and arranging for contract maintenance may result in delays. In this instance, the captain’s 
deferral of a maintenance check of the oil leak until after arrival in Atlanta and his failure to 
ensure that maintenance action was taken on the missing rivets appear to have been contrary to 
guidance contained in Delta’s Flight Operations Manual (FOM), which required flightcrews to 
notify Delta maintenance personnel of maintenance irregularities, or fluid leaks, at the gate. 
Flowever, the flightcrew’s decision was later supported by Delta management. This suggests that 
Delta management does not agree that fluid drops on the bullet nose or two missing rivets 
constitute maintenance irregularities. 

Thus, the Safety Board concludes that there is a lack of clarity in written guidance in the 
FOM to Delta flightcrews on what constitutes maintenance “discrepancies” and “irregularities” 
and when to contact maintenance personnel and to log anomalies. Therefore, the Safety Board 
believes that the FAA should require Delta Air Lines to review its operational procedures, with 
special emphasis on nonmaintenance stations, to ensure that flightcrews have adequate guidance 
about what constitutes a maintenance irregularity or discrepancy (including the presence of fluid 
drops in unusual locations) before departure, and that following this review Delta should, 
contingent on FAA approval, amend its FOM to clarify under what circumstances flightcrews 
can, if at all, make independent determinations to depart when maintenance irregularities are 
noted. Further, the Safety Board is concerned that similar situations may be encountered by 
flightcrews at other airlines. Therefore, the Safety Board believes that the FAA should have its 
principal operations inspectors review these policies and procedures at their respective operators 
to clarify, if necessary, these flightcrew responsibilities. 

Crew Actions and Survival Factors 

Immediately following the engine failure, the circumstances in the aft cabin were 
markedly different than those in the forward cabin. The aft flight attendants were presented with 
structural damage, serious injuries, and an engine fire, any one of which was sufficient to initiate 
an evacuation pursuant to Delta’s policy and procedures. In contrast, the cockpit crew and 
forward flight attendant were unaware of these circumstances and, based on the absence of any 
indications of fire, the captain determined that an evacuation was not warranted. Unaware that 
passengers were evacuating, the captain did not shut down the engines until the first officer 
alerted him to do so after having walked through the cabin to assess the situation. 

The interphone system was inoperative at the critical moment when decisions were being 
made by the aft flight attendants to evacuate and by the captain not to evacuate. Thus, neither of 
these decisions, nor the information on which they were based, could be immediately 
communicated to crewmembers at the opposite end of the airplane. By the time emergency 
electrical power was restored to the interphone and the first officer again attempted to contact the 
aft flight attendants, the flight attendants were no longer in a position to, and would not have 
been expected to, respond to calls over the interphone because they were carrying out the 
evacuation and attending to injured passengers. 

The Safety Board concludes that neither the aft flight attendants’ decision to evacuate nor 
the captain’s decision not to evacuate was improper in light of the information each of them had 
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available at the time. However, the Safety Board is troubled by the lack of communication 
among crewmembers in the front and back of the airplane. Specifically, the Safety Board is 
concerned that crewmembers in the cockpit were unaware that emergency conditions existed and 
an evacuation was ongoing in the rear of the airplane. Even if this information would not have 
affected the captain’s determination not to evacuate the entire airplane, at the very least it likely 
would have prompted him to immediately shut down the engines to minimize the hazards to 
those passengers who were evacuating. 

The Safety Board has long been concerned about the difficulties that can arise when 
normal means of communication (interphone and/or public address systems) become unavailable 
during an emergency situation, when they generally are most needed. Evacuation decisions, 
which must often be made very quickly, should be based on the most complete information 
possible about the condition of the airplane and possible hazards. As noted in an accident report 
on the December 20, 1995, accident involving Tower Air flight 41 at JFK International Airport, 25 
“positive communications are essential to coordinate the crew’s response, even if the decision is 
not to evacuate.” 

In 1972 and 1981 the Safety Board recommended that the FAA require independently 
powered evacuation alarm systems. However, at that time, the FAA determined that the cost of 
installing such alarm systems “would far outweigh any identifiable safety benefits.” Thus, in 
most airplanes today, if there is a loss of airplane electrical power, crewmembers and passengers 
in one part of the airplane may not be aware of an evacuation that is occurring in another part of 
the airplane. Because a decision to evacuate generally indicates that there may be a hazard to 
passengers if they remain on board, the Safety Board remains concerned that the lack of an 
independently powered evacuation alarm system on most airplanes is a significant safety 
deficiency that should be corrected. 

The Safety Board concludes that every passenger-carrying airplane operating under 14 
CFR Part 121 should have a reliable means to ensure that all crewmembers on board the airplane 
are immediately made aware of a decision to initiate an evacuation. Therefore, the Safety Board 
believes that the FAA should require that all newly manufactured passenger-carrying airplanes 
operated under 14 CFR Part 121 be equipped with independently powered evacuation alarm 
systems operable from each crewmember station. The FAA should also require carriers 
operating airplanes so equipped to establish procedures, and provide training to flight and cabin 
crews, regarding the use of such systems. The issue of retrofitting existing airplanes with such 
systems will be addressed in the Safety Board’s upcoming evacuation study. 

As illustrated in this accident, emergency exits are sometimes opened by passengers 
before any evacuation order has been given or any decision has been reached. It is important for 
cockpit crews to know that exits have been opened for any reason so that appropriate measures 


25 National Transportation Safety Board. 1996. Runway Departure During Attempted Takeoff, Tower Air 
Flight 41, Boeing 747-136, JFK International Airport, New York, December 20, 1995. Aircraft Accident Report 
NTSB/AAR-96/04. Washington, DC. 
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can be taken to minimize the resulting potential hazards to passengers who may be departing the 
airplane through those exits. The Safety Board is aware that some airplanes, including the MD- 
88, are equipped with cockpit indicators showing open exits, but the Safety Board concludes that 
safety could be enhanced if all cockpit crews were immediately made aware of when exits are 
opened during an emergency. Therefore, the Safety Board believes that the FAA should require 
that all newly manufactured airplanes be equipped with cockpit indicators showing open exits, 
including overwing exit hatches, and that these cockpit indicators be connected to emergency 
power circuits. The issue of retrofitting existing airplanes will be addressed in the Safety Board’s 
upcoming evacuation study. 

Finally, the Safety Board is concerned that the overwing exits were opened while the 
airplane was still moving. The passenger who opened that exit told Safety Board investigators 
that he was uncertain whether he should open the exit and wished that he had received some 
guidance as to when it should be opened. The ’’Passenger Safety Information” card made 
available to each passenger on the Delta MD-88 illustrates how to open the exits, and states that 
persons seated in emergency exit seats must be able to “[a]ssess whether opening the emergency 
exit will increase the hazards to which passengers may be exposed.” However, the card does not 
specifically state when the exit should be opened or describe the conditions under which doing so 
might increase the hazards to which passengers might be exposed. Nor does the card state that 
the exit should not be opened until the airplane has come to a stop. The Safety Board concludes 
that the guidance provided to passengers on Delta Air Lines MD-88s regarding when emergency 
exits should and should not be opened is not sufficiently specific. The Safety Board is also 
concerned that guidance provided by other airlines on other airplanes might be similarly vague. 
The Board will address this issue further in its upcoming evacuation study. 

As a result of the investigation of this accident, the National Transportation Safety Board 
recommends the following to the Federal Aviation Administration: 

Form a task force to evaluate the limitations of the blue etch anodize and other 
postmanufacturing etch processes and develop ways to improve the likelihood that 
abnormal microstructure will be detected. (A-98-9) 

Inform all manufacturers of titanium rotating engine components of the potential 
that current boring and honing specifications may not be sufficient to remove 
potential defects from holes and ask them to reevaluate their manufacturing 
specifications and procedures with this in mind. (A-98-10) 

Establish and require adherence to a uniform set of standards for materials and 
procedures used in the cleaning, drying, processing, and handling of parts in the 
fluorescent penetrant inspection process. In establishing those standards, the FAA 
should do the following: 

Review the efficacy of drying procedures for aqueously cleaned rotating 
engine parts being prepared for fluorescent penetrant inspections; 
(A-98-11) 
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Determine whether flash drying alone is a sufficiently reliable method; 
(A-98-12) 

Address the need to ensure the fullest possible coverage of dry developer 
powder, particularly along hole walls; (A-98-13) 

Address the need for a formal system to track and control development 
times; (A-98-14) and 

Address the need for fixtures that minimize manual handling of the part 
without visually masking large surfaces of the part. (A-98-15) 

Require the development of methods for inspectors to note on the part or 
otherwise document during a nondestructive inspection the portions of a critical 
rotating part that have already been inspected and received diagnostic follow up to 
ensure the complete inspection of the part. (A-98-16) 

Conduct research to determine the optimum amount of time an inspector can 
perform nondestructive testing inspections before human performance decrements 
can be expected. (A-98-17) 

In conjunction with industry and human factors experts, develop test methods that 
can evaluate inspector skill in visual search and detection across a representative 
range of test pieces, and ensure proficiency examinations incorporate these 
methods and are administered during initial and recurrent training for inspectors 
working on critical rotating parts. (A-98-18) 

Require that all heavy rotating titanium engine components (including the JT8D- 
200 series fan hubs) receive appropriate nondestructive testing inspections 
(multiple inspections, if needed) based on probability of detection data at intervals 
in the component’s service life, such that if a crack exists, but is not detected 
during the first inspection, it will receive a second inspection before it can 
propagate to failure; assuming that a crack may begin to propagate immediately 
after being put into service, as it did in the July 6, 1996, accident at Pensacola, 
Florida, and in the July 19, 1989, United Airlines accident at Sioux City, Iowa. 
(A-98-19) 

Require, as an interim measure, pending implementation of Safety 
Recommendation A-98-19, that critical rotating titanium engine components that 
have been in service for at least 2 years receive a fluorescent penetrant inspection, 
eddy current, and ultrasonic inspection of the high-stress areas at the engine’s next 
shop visit or within 2 years from the date of this recommendation, whichever 
occurs first. (A-98-20) 
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Require Delta Air Lines to review its operational procedures, with special 
emphasis on nonmaintenance stations, to ensure that flightcrews have adequate 
guidance about what constitutes a maintenance irregularity or discrepancy 
(including the presence of fluid drops in unusual locations) before departure, and 
that following this review Delta should, contingent on FAA approval, amend its 
flight operations manual to clarify under what circumstances flightcrews can, if at 
all, make independent determinations to depart when maintenance irregularities 
are noted. Further, the FAA should have its principal operations inspectors review 
these policies and procedures at their respective operators to clarify, if necessary, 
these flightcrew responsibilities. (A-98-21) 

Require that all newly manufactured passenger-carrying airplanes operated under 
14 Code of Federal Regulations Part 121 be equipped with independently powered 
evacuation alarm systems operable from each crewmember station, and establish 
procedures and provide training to flight and cabin crews regarding the use of 
such systems. (A-98-22) 

Require that all newly manufactured airplanes be equipped with cockpit indicators 
showing open exits, including overwing exit hatches, and that these cockpit 
indicators be connected to emergency power circuits. (A-98-23) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA, and BLACK concurred in these recommendations. 



By: Jim Hall 

Chairman 
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National Transportation Safety Board 

Washington, D.C. 20594 

Safety Recommendation 


Date: February 26, 1998 
In reply refer to: A-98-24 


Honorable Jane F. Garvey 
Administrator 

Federal Aviation Administration 
Washington, D.C. 20591 


On November 24, 1996, the flightcrew of Northwest Airlines (NWA) flight 211, an Airbus 
A-320-211, N310NW, experienced stiff rudder pedals approximately 50 feet above the ground 
before landing at Detroit Metropolitan Airport, Michigan. The flight, which was operating under 
the provisions of Title 14 Code of Federal Regulations Part 121 as a regularly scheduled 
passenger flight from Ft. Lauderdale, Florida, to Detroit, landed without further incident. The 6 
crewmembers and 141 passengers were not injured. Instrument meteorological conditions 
prevailed at the time of the incident. 

The captain of the flight stated that he had disengaged the autopilot (A/P) approximately 
15 miles from the airport and was flying a manual approach. No problems were observed with the 
rudder or yaw damper during this time. However, when the captain attempted to use the rudder 
to compensate for a crosswind just before landing, he discovered that the rudder pedals were 
“locked in the neutral position.” The captain used aileron inputs to keep the airplane aligned with 
the runway centerline through the touchdown and differential braking to steer the airplane during 
the landing roll until he engaged nosewheel steering at 80 knots. After exiting the runway, the 
captain performed several A/P disconnects, with no change in the rudder pedal force. He and the 
first officer then made several attempts to free the rudder pedals. After manipulating the rudder 
for approximately 15 seconds, the rudder pedal movement returned to normal. 

Following the incident, NWA maintenance personnel examined the rudder and A/P 
systems. No anomalies were observed and no evidence of water or ice was found on the rudder 
cable assemblies. The rudder A/P artificial feel and trim solenoid was removed and replaced, and 
the airplane was returned to service the day after the incident. Subsequent Safety Board analysis 
of the flight data recorder readout confirmed that the A/P was disengaged when the captain 
experienced stiff rudder pedals. 
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At the request of the Safety Board, the rudder artificial feel and trim unit from the airplane 
was tested at an Airbus laboratory under supervision of the French Bureau Enquete Accidents. 
Although the unit’s solenoid functioned properly, excessive forces were required to rotate the 
unit s A/P-mode engagement/disengagement lever. This occurred during testing at ambient and 
cold temperatures (-40° F). 

A review of the service history on the A-320 rudder system revealed Airbus Service 
Bulletin (SB) A320-27-1042-, dated March 21, 1992, titled “Flight Controls - Rudder - Increase 
Radial Play of Lever Bearing in the Artificial Feel and Trim Unit.” The SB was prompted by 10 
incidents in which the artificial feel and trim unit did not disengage from the A/P mode (stiff pedal 
operation) and return to normal pedal operating forces during approach and landing. These 
failures were attributed to increased operating forces in the bearing of the A/P 
engagement/disengagement lever in the artificial feel and trim unit and may have been aggravated 
by exposure to cold temperatures. The SB introduced a modified lever with a larger radial play 
of the bearing to eliminate the problem. On April 30, 1997, Airbus sent a telex to A-320 
operators citing two recent incidents involving stiff rudder pedals and strongly recommending that 
the SB action be incorporated. The Direction Generale De L’Aviation Civile, the French aviation 
authority, has not issued an airworthiness directive (AD) to require the SB modification (which is 
not mandatory). 

The NWA A-320 involved in the November 24, 1996, incident had not been modified in 
accordance with the SB. Because an unexpected restriction of the rudder pedals could cause a 
loss of control during a critical phase of flight, the Safety Board believes that the Federal Aviation 
Administration should issue an AD to require the installation of a modified 
engagement/disengagement lever in the rudder artificial feel and trim unit on all Airbus A-320 
airplanes, in accordance with Airbus SB A320-27-1042, to ensure that the correct operating force 
exists at the rudder pedals. Although the SB modification has been incorporated on most of the 
A-320 airplanes operating in the United States, America West has indicated that some of its 
airplanes have probably not been modified. Full fleet compliance is necessary to ensure that none 
of the remaining airplanes are affected by this known system problem. The Safety Board is also 

concerned that A-320 airplanes could enter into U.S. service in the future without the SB 
modification. 

Therefore, the National Transportation Safety Board recommends that the Federal 
Aviation Administration: 

Issue an airworthiness directive to require the installation of a modified 
engagement/disengagement lever in the rudder artificial feel and trim unit on all 
Airbus A-320 airplanes, in accordance with Airbus Service Bulletin A320- 
27-1042, to ensure that the correct operating force exists at the rudder pedals (A- 
98-24) 
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Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA, and BLACK concurred in this recommendation. 
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National Transportation Safety Board 

Washington, D.C. 20594 
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Date: February 25, 1998 
In reply refer to: A-98-25 and -26 


Honorable Jane F. Garvey 
Administrator 

Federal Aviation Administration 

Washington, D.C. 20591 _______. 

On January 26, 1997, Northwest Airlines (NWA) flight 20, a Boeing 747-251, N627US, 
experienced an engine case rupture of its No. 1 Pratt & Whitney (P&W) JT9D-7Q engine during 
takeoff at Narita International Airport, Tokyo, Japan. During the takeoff roll, as engine power 
was set to approximately 1.58 engine pressure ratio and the airplane was rolling forward at low 
speed, a loud bang was heard by the flightcrew. The captain rejected the takeoff and returned to 
the gate without further incident; no injuries resulted. The crew reported that there were no fire 
warning or nacelle overheat indications. The airplane was operated under Title 14 Code of 
Federal Regulations Part 121, as a regularly scheduled passenger flight from Tokyo, Japan, to 
Minneapolis, Minnesota. 

The No. 1 engine diffuser case ruptured and as a result, both engine side cowl doors, a 
precooler, and other hardware were ejected from the engine. The escaping gas and engine debris 
blew out the engine pylon access panels, and created holes, cracks, and other damage to the 
wing’s leading edge, aileron, and flaps. Engine debris came to rest on the only runway at the 
airport, causing the airport to be closed for several hours. 

The National Transportation Safety Board’s (NTSB) examination of the engine 
discovered an L-shaped crack in the outer pressure wall in the rear skirt area of the diffuser case 
that was deflected outward exposing the bulged combustion chamber inside the engine. The 
crack extended fore and aft approximately 18 inches from the diffuser case s rear flange at the 11 
o’clock 1 position. The crack turned 90° and extended circumferentially around approximately 
120° of the case’s circumference, in the counterclockwise direction. The crack passed adjacent to 
a 3-inch long, dog bone-shaped embossment (boss), located about 10 inches forward of the rear 
flange at the 11 o’clock position. The boss was the attachment point for the upper most mount 
bracket of the engine’s 116-pound precooler. 2 


1 All references to the clock are as viewed from aft looking forward. 

2 The precooler is an air-to-air heat exchanger that cools the engine bleed air from the high-pressure compressor 
(HPC) with cooler fan discharge (ram) air. Pressurized air from the HPC is regulated by 8 - and 15 -stage bleed 
air valves before entering the precooler. Ram air is regulated by two valves as it exits the precooler. 
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A section of the diffuser case rear skirt (see figure 1) was examined at the Safety Board’s 
materials laboratory in Washington, D.C. Examination of the fracture surface, approximately 
10 Vi inches from the rear flange, adjacent to the upper precooler mount boss, revealed a 5-inch 
long discolored high cycle fatigue 3 (HCF) zone with about 90,000 striations. The fatigue initiated 
at a crack that looked like two thumbnail-shaped, gray-colored areas, which were approximately 
0.040-inch wide by 0.010-inch deep. High levels of delta phase precipitate 4 were discovered in 
the thumbnail-shaped origin areas. Individual 0.0005 to 0.0008-inch deep toolmarks or scratches 
were found on the outer case wall extending the length of the origin area. Numerous additional 
toolmarks were found on the exterior surface of the rear skirt. The toolmarks were formed when 
the exterior surface of the case was machined (blended) during manufacture. The diffuser case 
had accumulated 9,342 total flight cycles 5 since new. 



Figure 1: Ruptured diffuser case 

A metallurgical analysis of the fracture surface indicated that the thumbnail-shaped cracks 
had initiated at the base of the toolmarks because of a combination of high residual stresses and 
low-cycle fatigue (LCF). The crack then propagated in HCF, as evidenced by the very small 
striation spacing found in the majority of the 5-inch long fatigue zone, after which the crack 
progressed to failure in tensile overload. 

Based on the morphology of the fracture, metallurgical tests were also conducted at 
P&W’s Mechanics and Material Engineering laboratory, in East Hartford, Connecticut, to 
evaluate the case material’s fatigue properties that were initiated by toolmarks. Specimens tested 
with toolmarks present were found to have one-fourth the predicted life of identical specimens 
tested without toolmarks. 


3 HCF is a phenomenon in which a crack progresses an incremental amount (one striation) as a result of the 
cyclical stresses associated with vibration. 

4 The delta phase precipitate is a normally existing high temperature phase in INCONEL 718 and was most likely 
formed by the elevated temperatures associated with the heat treatment process of the difiuser case. 

5 A flight cycle is one takeoff and landing. 

LCF is a phenomenon in which a crack progresses an incremental amount (one striation) as a result of the 
cyclical stresses associated with rise and fall of the engine’s internal pressure, temperature, or the revolutions per 
minute associated with each flight cycle. 
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Metallurgical examination of the precooler at the Safety Board’s materials laboratory 
revealed HCF cracks at the attach points of two internal support rods. Seven other rods with 
identical HCF cracks were found to have been previously weld repaired. Wear marks and contact 
marks were also found on the engine bracket and support link of the precooler’s upper attachment 
point. Additionally, a review of the maintenance records revealed that seven flight cycles before 
the diffuser case rupture, the engine had an in-flight shutdown (EFSD) because of a turbine 
cooling air (TCA) tube failure. The records revealed that during the inspection following the 
IFSD, the TCA tube mount clamp, which normally supports the tube at about mid-span, was 
discovered missing, and a station-4 static pressure sense line (Ps4) was also discovered to be 
fractured. The TCA tube and clamp, and the Ps4 line were replaced. The records also revealed 
that 260 flight cycles before the diffuser case rupture, a cracked lenticular seal 7 was discovered 
during disassembly of the high-pressure turbine. 

The incident aircraft had no engine vibration monitoring (EVM) equipment. Although no 
EVM equipment was installed, the fractured diffuser case and Ps4 line, the missing TCA tube, the 
precooler cracks, and the precooler bracket wear suggest a vibratory environment. As a result, 
the Safety Board’s investigation attempted to identify potentially vibratory resonant conditions or 
excitation sources within the engine. A vibration survey was performed at P&W on a normally 
operating JT9D-7R4 engine that had a similar diffuser case but no precooler. P&W also 
conducted finite element analyses of the JT9D-7Q’s TCA tube installation and the precooler 
installation to determine the stresses from an assumed engine oscillatory force equivalent to 2.5 
times the force of gravity, which is considered to be a high vibration level for this engine. Finally, 
P&W estimated the amount of vibratory excitation imparted to the engine because of a cracked 
lenticular seal. 

The results of the vibration survey did not reveal any resonant conditions or excitation 
sources stemming from normal engine operation. The finite element analysis of the precooler 
installation revealed that the stresses from a high vibrating engine were not sufficient to initiate a 
crack in the case. Finally, the maximum levels of vibration from a cracked lenticular seal, or from 
a supported or unsupported resonating TCA tube, were not of sufficient magnitude to be 
excitation sources. 

A review of the failure history of the JT9D-7Q since certification in 1978, revealed that 
this is the first diffuser case rupture originating in the rear skirt area. The JT9D-59A and -70, 
which have an interchangeable diffuser case with the JT9D-7Q, had two diffuser case rupture 
events early in their operation history; these originated in the front skirt area. Since the issuance 
of Airworthiness Directive 94-26-06, which requires inspection of the front skirt in the vicinity of 
the 1 S^-stage bleed air bosses, no additional ruptures have originated in the front skirt area. 

The proximity of the crack origin to the precooler mount boss and the HCF crack 
propagation suggests that high precooler vibration imparted higher than normal loading into the 
precooler mount boss and the diffuser case. Additionally, the postincident fatigue tests of the case 
material indicates that high levels of vibration alone are insufficient to initiate a crack. The 


7 The lenticular seal is a torroid-shaped, steel seal clamped between the l“-and 2 nd -stage HPT disks that 
incorporates four knife edge seals around the outer diameter. 
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evidence also suggests that a tool mark or other defect in the case, combined with LCF, is 
required to initiate a crack and that high levels of vibration can propagate the crack. 

As a result, P&W reports that it is drafting a service bulletin to propose a repair for 
toolmarks stemming from the blending of the diffuser case during manufacture. Additionally, 
Boeing reports that it is drafting a service letter that proposes a rework of the engine bracket to 
the precooler’s upper attachment point on the JT9D-7Q installation to increase clearance between 
the bracket and support link to reduce vibration and to reduce wear. 

Because it appears that preventative measures can obviate future diffuser case ruptures 
originating in the rear skirt area with minimal impact to airline operations, the Safety Board 
believes that the Federal Aviation Administration (FAA) should require a one-time visual 
inspection of the diffuser case rear skirt on P&W JT9D-7Q engines to locate scratches and tool 
marks when the diffuser case is next at the piece-part level, and blend repair as required to prevent 
tool marks and scratches from becoming crack initiation sites. The Safety Board also believes 
that the FAA should require modification of the engine bracket that attaches to the diffuser case’s 
precooler upper mount boss on the P&W JT9D-7Q installation to increase clearance between the 
bracket and support link to reduce vibration and to reduce wear. 

Therefore, the National Transportation Safety Board recommends that the Federal 
Aviation Administration: 

Require a one-time visual inspection of the diffuser case rear skirt on Pratt & 
Whitney JT9D-7Q engines to locate scratches and tool marks when the diffuser 
case is next at the piece-part level, and blend repair as required to prevent tool 
marks and scratches from becoming crack initiation sites. (A-98-25) 

Require modification of the engine bracket that attaches to the diffuser case’s 
precooler upper mount boss on the Pratt & Whitney JT9D-7Q installation to 
increase clearance between the bracket and support link to reduce vibration and to 
reduce wear. (A-98-26) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA, and BLACK concurred in these recomm endatio ns. 

Chairman 




National Transportation Safety Board 

Washington, D.C. 20594 
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Honorable Jane F. Garvey 
Administrator 

Federal Aviation Administration 
Washington, D.C. 20591 


On September 7, 1997, Canadian Airlines International flight CP30, a Boeing 767-300ER 
airplane, equipped with General Electric Aircraft Engines (GEAE) CF6-80C2B6F engines, 
experienced an uncontained failure 1 of the high-pressure compressor (HPC) stage 3-9 spool 
(figure 1) in the No. 1 (left) engine during takeoff at Beijing, China. The airplane was on a 
regularly scheduled passenger flight from Beijing to Vancouver, Canada. The flightcrew reported 
that during the initial part of the takeoff as the throttles were advanced, the No. 1 engine surged. 
This was followed by a fire warning in the cockpit and significant vibration in the airplane. The 
crew rejected the takeoff at a speed of about 20 knots and discharged both fire bottles for the No. 1 
engine. The engines were shut down, and the airplane was towed to the terminal without further 
incident. The 199 passengers and 10 crewmembers on board sustained no injuries. 


The examination of the engine revealed substantial damage in the area of the HPC. The 
HPC case was ruptured aft of the stage 2 variable stator vanes. The stage 3 disk portion of the HPC 
stage 3-9 spool had separated from the remainder of the spool, exited the engine, and broken into 
three pieces, all of which were recovered. The No. 1 engine’s right-hand thrust reverser cowl had a 
2-inch by 1-inch cut in the skin. The reported fire was caused by fuel that had leaked from a line 
that supplies pressure to the active clearance control” valve, which was severed by one of the 
liberated pieces of the 3 rd -stage disk. 


1 An uncontained engine failure occurs when an internal part of the engine fails and is ejected through the 
cowling. 

2 The active clearance control system provides air to externally cool the turbine cases to minimize the thermal 
growth of the cases that reduces the gaspath leakage between the turbine blade tips and turbine case air seals to 
improve an engine’s fuel efficiency. 
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Figure 1.—Typical 3-9 spool in cross section. 


The investigation of this incident is under the direction of the Transportation Safety Board 
of Canada (TSB). The National Transportation Safety Board, under the provisions of Annex 13 to 
the International Convention on Civil Aviation, is assisting the TSB with its investigation. 
Information gathered in the investigation thus far raises serious concerns that warrant action by the 
Federal Aviation Administration (FAA). 

The HPC stage 3-9 spool is a rotor component that is composed of disks joined together 
with integral spacer segments and end flanges and is made from Ti-6242 titanium alloy. 3 The 
incident spool, part number 1333M66G01, was a two-piece assembly made by GEAE in 1989. 4 
According to maintenance records, the spool had accumulated a total of 25,653 hours and 4,744 
cycles since new (CSN). The front portion of the spool was forged by Schlosser Forge Company 


3 Titanium-based alloy containing 6 percent aluminum, 2 percent tin, 4 percent zirconium, and 2 percent 
molybdenum. 

4 The stage 3-9 spool was first manufactured by GEAE in 1971 for the CF6-50 engine as a one-piece spool that was 
forged from a 16-inch diameter billet. (A billet is a semifinished round product from which a part is forged. The 
required diameter of a billet is achieved by hot-working [forging] of an ingot in several stages.) In 1980, the billet 
diameter was reduced to 13 inches to improve the inspectability and provide for more working of the material during 
forging. Also around 1980, GEAE began to produce two-piece spools from 12-inch and 13-inch diameter billets. In the 
two-piece configuration, the front (stages 3 through 5) and rear (stages 6 through 9) portions of the spool are forged 
separately. The forgings are then machined to a rectilinear shape (which has straight sides and perpendicular comers), 
welded together, heat treated, and machined to the final shape. Between 1988 and July 1995, GEAE produced two- 
piece spools that had the front and rear portions of the spool forged from 9-inch and 10-inch diameter billets, 
respectively. Until 1995, all two-piece spools received a postweld solution heat treatment followed by a slow cool 
down. In 1995, that process was replaced by a postweld stress-relief process. Also, in July 1995, GEAE started to 
produce two-piece spools forged from 8-inch diameter billets. 
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from a 9-inch diameter billet produced by Reactive Metals Incorporated (RMI), and the aft portion 
was forged by Wyman-Gordon Company from a 10-inch diameter billet produced by Titanium 
Metals Corporation of America. Both pieces were welded by GEAE, and machined to the final 
shape by Volvo Aero Corporation, Trollhattan, Sweden. 

Metallurgical examination of the 3 rd -stage disk of flight CP30’s HPC spool was conducted 
at the TSB’s engineering and the Safety Board’s materials laboratories. The examination revealed a 
fatigue fracture that was about 1 %-inchcs long and about '/ 2 -inch deep, emanating from an area (not 
a clear, specific origin) at or near the bottom of a dovetail blade slot. Metallographic examination 
of numerous sections from the area of the fracture revealed a band of abnormal microstructure that 
contained predominantly alpha phase (the Ti-6242 alloy outside of the area of abnormal 
microstructure contained a mixture of approximately equal amounts of alpha and beta phases ) and 
elevated oxygen levels. This band of abnormal microstructure extended from the front to the rear 
face of the 3 rd -stage disk and intersected the bottom of the dovetail slot. 

Microprobe and wavelength dispersive analysis of several locations along the band of 
abnormal microstructure revealed oxygen levels of 0.4 to 0.6 percent. The applicable GEAE 
specification for Ti-6242 titanium alloy, C50TF39-S4, restricts oxygen content to a maximum of 
0.15 percent. A spectrographic chemical analysis of the 3 rd -stage disk material away from the 
fracture area and well outside the band of abnormal microstructure showed that it conformed to the 
GEAE specification requirements for Ti-6242 alloy. Hardness tests showed that the maximum 
hardness in the oxygen-rich area was 43 on the Hardness Rockwell C scale (HRC). In comparison, 
the hardness in other areas of the spool ranged from 29 HRC to 40 HRC (averaging 35 HRC), 
which, according to GEAE, is typical for premium quality Ti-6242 alloy. 

Further, the examination of the fracture surface with a scanning electron microscope 
revealed that about 80 percent of the fatigue region contained brittle cleavage-like, 5 * 7 8 faceted features 
with no identifiable fatigue striations, and about 20 percent contained classical fatigue striations. 
Metallurgists were able to count about 800 classical fatigue striations along a radial line extending 
through the fatigue region from the dovetail slot bottom to the stage 3 disk bore. 

Adequacy of Current In-Service Inspection Techniques for Detecting Cracks 

The records for the incident engine show that in October 1994, the engine, including the 
HPC stage 3-9 spool, was overhauled because of the ingestion of recapped tire fragments into the 
engine during the takeoff roll. The overhaul was performed by Caledonian Airmotive, Prestwick, 
Scotland, at 2,758 CSN (1,986 cycles before the incident) and included a fluorescent penetrant 


5 When titanium takes the crystallographic form known as “alpha phase” (also referred to as a low-temperature 
titanium phase) it has a hexagonal close-packed crystal structure. When it takes the crystallographic form known as 
“beta phase” (also referred to as a high-temperature titanium phase) it has a body-centered cubic crystal structure. 

Applicable GEAE material specification C50TF39-S4 does not specify a required minimum or maximum 
hardness level for Ti-6242. 

7 Cleavage refers to the splitting of a crystallized substance along definite crystal planes. 

8 Caledonian Airmotive was subsequently acquired by Greenwich Aviall, and then by GE Caledonian. 
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inspection (FPI) 9 and an ultrasonic 10 inspection. The maintenance records show that neither the FPI 
nor the ultrasonic inspection revealed any rejectable indications in the spool. 11 

The investigation revealed that the FPI and ultrasonic inspection techniques performed on 
the spool in 1994, even when combined with the eddy current inspections, 12 which were 
subsequently included in the GEAE engine maintenance manual for the inspections of HPC stage 
3-9 spools, do not provide 100 percent inspection coverage of the spool. According to GEAE, the 
currently prescribed manner in which the ultrasonic inspection probe is directed at the spool’s disk 
bore results in several internal “blind spots” that are beyond the coverage capabilities of the 
ultrasonic inspection technique. The crack that resulted in the uncontained failure of flight CP30’s 
HPC stage 3-9 spool originated from an area located in one of these blind spots. The investigation 
determined that by repositioning the ultrasonic probe to the dovetail slot, this area could be fully 
inspected. However, it is uncertain whether, even if the probe had been repositioned, a detectable 
crack existed in the incident spool at the time of the 1994 inspections. 

The Safety Board concludes that because the currently prescribed in-service inspection 
techniques do not provide 100 percent inspection coverage of the HPC stage 3-9 spool, these 
inspections do not ensure the detection of all cracks. Although improved inspection coverage 
might not have affected the outcome of this incident, the Safety Board is nonetheless concerned that 
the inspection techniques currently in use permit blind spots in the area of the dovetail blade slots, 
which are high-stress areas of the spool. Therefore, the Safety Board believes that the FAA should 
require GEAE to develop and implement improved inspection techniques that will provide 100 
percent inspection coverage of high-stress areas of the CF6-50 and -80 series HPC stage 3-9 spool 
and that will provide the maximum coverage possible of other areas. The Safety Board is also 
concerned that the incomplete inspection coverage of multistage compressor spools may not be 
limited only to GEAE CF6-50 and -80 series HPC stage 3-9 spools, but may exist for other 
multistage compressor spools. Therefore, the Safety Board believes that the FAA should review 
the prescribed nondestructive inspection techniques for all turbine engine multistage titanium 
compressor spools to ensure 100 percent inspection coverage of high-stress areas and maximum 
coverage possible for all other areas and, if necessary, require engine manufacturers to develop and 
implement improved inspection techniques. 


During FPI, a dye is applied to the surface of the part. The dye penetrates cracks and leaves a surface 
indication detectable with fluorescent light. 

l0 Ultrasonic inspection is a nondestructive method in which beams of high-frequency sound waves are 
introduced into materials to detect subsurface flaws in the material. 

GEAE, Air Accident Investigation Branch of the United Kingdom, and Safety Board personnel reviewed the strip 
charts from the ultrasonic inspection and confirmed that there were no indications requiring any action. (A strip chart is 
a continuous length of graph paper that is used to record data in relation to time or distance.) 

12 

Eddy current inspections measure fluctuations in an alternating magnetic field around a part generated by a 
transducer carrying an alternating current. The inspection is used to locate surface and near-surface defects. Eddy 
current inspections of the HPC stage 3-9 spool were not performed in 1994, when the incident engine and spool were 
last overhauled. 
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Possible Role of Melt Deviations in Creating Abnormal Microstructure 

The investigation has not formally determined the cause of the abnormal microstructure in 
the incident spool. However, investigators are examining the possibility that it was related to 
deviations in the melt process that allowed the introduction of oxygen into the melt. The 
manufacturing records of the ruptured HPC stage 3-9 spool from flight CP30 indicate that the 
forward section of the spool (stages 3 through 5) was produced by RMI from Heat 13 No. 981897. 
RMI’s manufacturing records for that heat indicate that the titanium electrode 14 shifted position 
within the crucible 15 during the second melt. The manufacturing records also indicate that about 
the same time as the electrode’s shift in position, the pressure inside the crucible increased from the 
normal vacuum of about 100 microns of atmospheric pressure to 900 microns of atmospheric 
pressure. 16 This increase occurred over the space of 1 minute. Approximately 30 minutes later, the 
pressure had returned to the normal vacuum of about 100 microns of atmospheric pressure. 
According to RMI, it is likely that the increase in pressure resulted from the electrode’s shift in 
position, which could have allowed the cooling water from the jacket that surrounds the crucible to 
leak into the melt. Although the extent of the pressure change (known as a “vacuum excursion”) 
was within RMI and GEAE specifications, which permitted pressure deviations of up to 1,000 
microns during the second melt, RMI notified GEAE of the vacuum excursion. 17 GEAE accepted 
the melt. Subsequently, in October 1991, RMI reduced the specifications for permissible vacuum 
excursions during secondary and final melts to 750 microns. 

A review of GEAE manufacturing records showed that 21 HPC stage 3-9 spools, in 
addition to the flight CP30 spool, were manufactured from RMI Heat No. 981897. 18 On 
October 31, 1997, the FAA issued Airworthiness Directive (AD) 97-22-14, which required the 
removal from service of all 21 spools within 30 days. The FAA and GEAE have advised the Safety 
Board that all of the other HPC stage 3-9 spools that had been manufactured from RMI Heat 
No. 981897 have been removed from service. According to GEAE, one of those spools has 


i3 A heat, or ingot, is a mass of metal melted into a convenient shape for handling that is later finished by rolling, 
forging, or other means. 

,4 Titanium electrodes for the first (primary) melt consist of cold-pressed compacts containing a mixture of 
titanium sponge and elemental alloying materials that are welded together into an approximately 15-foot long, 
18-inch diameter cylinder. The electrode in the second (intermediate) melt is produced by welding together two or 
three primary melt ingots end to end. The electrode in the third melt is the melted together mass from the second 
melt. 

l5 The crucible is a water-cooled copper vessel in which the titanium electrode is melted. 

l6 An absolute vacuum is zero microns. A standard day pressure of 29.92 inches of mercury is equivalent to 
9,875,118 microns. 

’’According to RMI, it notified GEAE of the vacuum excursion because it was close to the maximum excursion 
allowable (within 100 microns) and its time span was unusually long (approximately 30 minutes). 

l8 Of these, only one spool was installed in a U.S.-registered airplane, a Continental Airlines DC-10, N87071. This 
spool had accumulated 1,075 CSN, far less than the 4,744 cycles that had been accumulated on the spool from flight 
CP30. 
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received an ultrasonic, eddy current, and blue-etch anodize (BEA) inspection, 19 and there were no 

20 

indications of defects or cracks. 

According to GEAE, there have been 10 uncontained HPC stage 3-9 spool failures in 
CF6-50 and -80 series engines. 21 GEAE further indicated that two of these failures, occurring in 
1974 and 1979, were caused by fatigue fractures originating from oxygen-rich inclusions in the 
spools. These spools, which were produced from 16-inch diameter billets melted by RMI, had 
reportedly accumulated 483 and 2,854 CSN, respectively, at the time of the failures. In a 
December 5, 1997, letter to the TSB, RMI stated that the furnace records for the two heats from 
which these spools had been produced showed that minor vacuum excursions had occurred during 
the initial melt but that those excursions were typical for the production process that was in use and 
well within RMI and GEAE specification limits. Records also show that one of the heats had an 
excursion of 600 microns in the second melt (which was within the then-current limits and is within 
the revised limits for secondary melts). 

The Safety Board is concerned that additional HPC stage 3-9 spools or other critical 
components manufactured from ingots that contain melt variations that can result in abnormal 
microstructure may be currently in service. Therefore, the Safety Board believes that the FAA 
should review GEAE’s Ti-6242 titanium alloy suppliers’ melting records and identify any vacuum 
excursions or other process deviations that exceed current specifications or that may otherwise 
cause an inclusion or abnormal microstructure. The Safety Board also believes that based on the 
results of this review, the FAA should issue an AD to require removal from service and/or 
inspections of the components manufactured from these melts. 

Rapid Propagation of the Crack and the Possible Role of Dwell Time Fatigue 

As mentioned above, the fracture morphology of the incident spool was atypical in that 
most of the fracture region contained brittle cleavage-like, faceted features, rather than classical 
fatigue striations. Further, the areas of classical fatigue striations included evidence of only 800 
flight cycles, indicating a very rapid crack propagation. This fracture morphology is similar to that 


19 In 1991, GEAE began performing BEA inspections on the surface of newly manufactured spools as a further 
measure to prevent spools with microstructural anomalies from being put into service. However, within areas of 
generally abnormal microstructure, the arrangement of alpha and beta grains may be such that a given cross-section 
of the material may not indicate an abnormality that would be apparent from a different view. Therefore, although it 
is possible that a BEA inspection could detect an area of abnormal microstructure such as that in the incident spool, 
it is also possible that the microstructure at the surface might not exhibit an abnormal appearance and thus would not 
be detected by a BEA inspection. 

20 The AD did not require that the spools be subjected to testing after being removed from service. 

21 The Safety Board has previously expressed concern about the continued airworthiness of GEAE CF6-50 and -80 
series engine HPC stage 3-9 spools. In 1995, the Safety Board assisted the Egyptian Civil Aviation Authority with the 
investigation of an uncontained failure of a GEAE CF6-50 HPC stage 3-9 spool that occurred on an Egypt Air Airbus 
A300B4 during takeoff at Cairo, Egypt, on April 10, 1995. The failure of that spool was caused by a fatigue crack that 
initiated from a nitrogen-stabilized hard-alpha inclusion in the web portion of the stage 6 disk. 
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exhibited in several earlier fractures of CF6-50 and -80 series 3-9 spools 22 that were attributed to a 
cracking phenomenon that became known as dwell time fatigue (DTF). (The Safety Board first 
became aware of DTF in 1995 during the investigation of the uncontained failure of the CF6-50 
stage 3-9 spool that occurred on the Egypt Air Airbus A300.) 

DTF refers to a fracture mechanism in which progressive crack growth occurs during cyclic 
loading (rise and fall of stress) and also over time during sustained peak-stress loading (during the 
dwell time at the peak stress level), both at low temperature. The fracture morphology is 
characterized by subsurface initiation and brittle, faceted-cleavage fracture features. According to 
GEAE, the DTF phenomenon is related to increased plastic strain and slip along 
crystallographically aligned alpha colonies 23 in the material microstructure. According to 
metallurgical research literature, the faceted fracture features that occur during DTF in alpha-beta 
titanium alloys are associated with large primary alpha colonies possessing a similar 
crystallographic orientation. 24 Other literature indicates that DTF develops at high stresses 
(approaching the yield stress of the material) and is associated with hydrogen embrittlement 
developed during time-dependent plastic deformation at the dwell stress. 

GEAE conducted a test program 26 that indicated that a significant reduction in a material’s 
fatigue life occurs when it is subject to DTF as compared to conventional fatigue cycling. 
However, GEAE has been unable to determine the time it takes from manufacture until a crack 
initiates or the propagation rate of a crack once it initiates in DTF. Absent a predictable crack 
initiation time and propagation rate (which can be used to establish required inspection intervals 
designed to detect cracks before they propagate to failure), the prior failure history of the 
component provides the only data on which to base inspection intervals. 

On August 25, 1995, as a result of a review of the spool failures associated with the DTF 
phenomenon, the Safety Board issued Safety Recommendation A-95-85 urging the FAA to revise 
AD 95-03-01 (applicable to GEAE CF6-50, -80A, and -80C2 model engines) to require repeated 
inspection of all HPC stage 3-9 spools that had been solution heat treated after welding 27 The 


22 0f the 10 aforementioned uncontained HPC stage 3-9 spool failures, GEAE attributed 4 of the failures to the DTF 
fracture mechanism, [(a) the 1985 failure in Dakar, Senegal, of a CF6-50, stage 9 disk with 4,075 CSN, which was part 
of a one-piece spool; (b) the 1991 failure in Seoul, Korea, of a CF6-50, stage 9 disk with 10,564 CSN, which was part of 
a one-piece spool; (c) the 1993 failure in Los Angeles, California, of a CF6-80C2 stage 6 disk with 4,403 CSN, which 
was part of a one-piece spool; and (d) the 1995 failure in Bangkok, Thailand, of a CF6-50 stage 8 disk with 8,438 CSN, 
which was part of a one-piece spool.) 

23 Crystallographically aligned alpha colonies are areas of the microstructure in which a group of alpha grains in 
proximity to one another have their crystallographic planes similarly oriented. 

24 Woodfield, A.P. et. al. 1995. “Effect of Microstructure on Dwell Fatigue Behavior of Ti-6242.” Titanium 
'95: Science and Technology, p. 1116-1123. 

25 Hack, J. E.; Leverant, G. R. 1982. “The Influence of Microstructure on the Susceptibility of Titanium Alloys to 
Internal Hydrogen Embrittlement.” Metallurgical Transactions, Volume 13A. p. 1729-1738. 

26 The results of this test program are documented in “Effect of Microstructure on Dwell Fatigue Behavior of 
Ti-6242,” published in Titanium '95: Science and Technology. (See complete citation in footnote 24, above). 

27 Until 1995, all two-piece spools received a postweld solution heat treatment followed by a slow cool down. In 
1995, according to GEAE, it replaced the solution heat treatment process with a postweld stress-relief process to 
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Safety Board urged that the maximum interval between inspections should be appropriately less 
than the 4,000 cycles specified in that AD. 28 

The FAA responded that it agreed with the safety recommendation to require inspections of 
most GEAE CF6-50, -80A, and -80C2 HPC stage 3-9 spools but did not agree that there should be 
a maximum interval between all inspections. On November 13, 1995, the FAA issued AD 95-23- 
03, superseding AD 95-03-01, which reduced the repetitive inspection interval requirements for 
one-piece F1PC stage 3-9 spools made from 16-inch diameter billets used in GEAE CF6-50, -80A 
and -80C2 engines from a maximum of 4,000 cycles to a maximum of 3,500 cycles. A 3,500-cycle 
inspection interval was also established for spools made from 13-inch diameter billets that are used 
on GEAE CF6-80C2 engines. However, the FAA did not make any requirements for mandatory 
repetitive inspections for one-piece HPC spools made from 13-inch diameter billets installed in 
CF6-80A engines or on any spools made from two-piece forgings. 

In its April 16, 1996, response to the FAA, the Safety Board expressed its concern that 
further failures of stage 3-9 spools could occur at the 3,500-cycle inspection interval and stated that 
it believes the 3,500-cycle inspection interval was based primarily on economic considerations, not 
on fracture propagation or low-cycle failure events. The Safety Board response further stated that 
the earliest DTF separation of a compressor spool had occurred after 4,075 CSN in a spool made 
from a 16-inch diameter billet. The Safety Board also investigated the separation of an HPC spool 
made from a 13-inch diameter billet that occurred in a CF6-80C2 engine after 4,403 CSN. The 
pieces of the separated spool containing the fracture origin area were not recovered, so the exact 
fracture mechanism was not determined. However, the investigation concluded that the aligned 
alpha colonies in the microstructure of the spool made it susceptible to DTF. These spool 
separations indicate that complete failure resulting from DTF can occur after a relatively low 
number of cycles. 

In a December 3, 1996, letter, the Safety Board indicated that AD 95-23-03 did not satisfy 
the intent of Safety Recommendation A-95-85, and the recommendation was classified “Closed— 
Unacceptable Action.” 

The Safety Board notes that in addition to having a fracture morphology similar to that of 
the spools that failed from DTF, the fracture of the stage 3 disk on flight CP30 initiated at a 
subsurface location in an area of high stress, and the material microstructure contained an aberrant 
alpha structure. Although the fracture initiation area of the flight CP30 spool did not exhibit 
crystallographically aligned alpha grains, such as has been associated with previous DTF fractures, 
it did contain an area of predominately alpha phase. In contrast, the fracture mechanism on the 
spool of the Egypt Air Airbus A-300 that failed in 1995, which was also made from Ti-6242, 


eliminate what GEAE had determined to be a propensity for grain growth and crystallographically aligned alpha 
colonies that occurred during the slow cool down from high temperature. 

28 

AD 95-03-01, issued on February 16, 1995, required repetitive (at intervals not to exceed 4,000 cycles) 
ultrasonic and eddy current inspections of spools made from 16-inch diameter billets. (AD 91-20-01, issued 
October 25, 1991, had earlier required one-time [within 3,500 cycles] ultrasonic and eddy current inspections of 
spools made from 16-inch diameter billets.) 
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showed classical fatigue striations that correlated by striation count to the total engine cycles for the 
spool (indicating much slower propagation rates than those produced by DTF). Further, the fracture 
features on the Egypt Air spool did not contain cleavage-like, faceted fractures like those associated 
with DTF, nor did the microstructure contain any aberrant alpha phase. This shows that not all 
fatigue failures of the Ti-6242 alloy exhibit this unusual fracture morphology and those that do have 
aberrant alpha phase in the microstructure. 

This suggests that although stage 3-9 spools made from Ti-6242 that have a normal, 
homogeneous alpha/beta microstructure can operate in service free of any cracking, if the spool has 
an abnormal alignment or distribution of alpha grains in a high-stress area, it can fracture 
unpredictably and rapidly. Although the Safety Board recognizes that failures associated with DTF 
and the failure of the 3-9 spool from flight CP30 might also have been affected by other 
as-yet-unknown factors, the Safety Board concludes that CF6-50 and -80 series HPC stage 3-9 
spools may be uniquely susceptible to unpredictable crack-initiation times and rapid-crack growth 
rates. Therefore, the Safety Board believes that the FAA should conduct a critical design review of 
CF6-50 and -80 series HPC stage 3-9 spools to assess the overall safety and soundness of the part. 
The review should, at a minimum, evaluate the following: the adequacy of current and past 
manufacturing processes, including the ability of current and previous melt specifications and 
postweld procedures to protect against the creation of microstructural abnormalities; the propriety 
of using Ti-6242 titanium alloy, including the possible susceptibility of this alloy to the 
development of aberrant or undesirable crystallographic arrangements of alpha phase and a 
resulting vulnerability to rapid cracking; and the adequacy of the stress margins for the spool in the 
presence of an aberrant or undesirable microstructure. 

Further, the Board remains concerned that not all CF6-50 and -80 series HPC stage 3-9 
spools are required to be subjected to repeated inspections at intervals appropriately less than 4,000 
cycles. Further, because it is not yet known (because the change is too recent) whether the cessation 
in 1995 of the postweld solution heat treatment has eliminated the susceptibility of those parts to 
DTF, it is possible that even those spools that were not subjected to this process are vulnerable. 
Therefore, the Safety Board believes that the FAA should revise AD 95-23-03, applicable to GEAE 
CF6-50, -80A, and -80C2 model engines, to include the -80E model engines, and to require 
repeated inspections of all HPC rotor stage 3-9 spools at maximum intervals appropriately less than 
4,000 cycles. 

Therefore, the National Transportation Safety Board recommends that the Federal Aviation 
Administration: 

Require General Electric Aircraft Engines to develop and implement improved 
inspection techniques that will provide 100 percent inspection coverage of high- 
stress areas of the CF6-50 and -80 series high-pressure compressor stage 3-9 spool 
and that will provide the maximum coverage possible of other areas. (A-98-27) 

Review the prescribed nondestructive inspection techniques for all turbine engine 
multistage titanium compressor spools to ensure 100 percent inspection coverage of 
high-stress areas and maximum coverage possible for all other areas and, if 
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necessary, require engine manufacturers to develop and implement improved 
inspection techniques. (A-98-28) 

Review General Electric Aircraft Engines’ Ti-6242 titanium alloy suppliers’ melting 
records and identify any vacuum excursions or other process deviations that exceed 
current specifications or that may otherwise cause an inclusion or abnormal 
microstructure. Based on the results of this review, issue an airworthiness directive 
to require removal from service and/or inspections of the components manufactured 
from these melts. (A-98-29) 

Conduct a critical design review of CF6-50 and -80 series high-pressure compressor 
stage 3-9 spools to assess the overall safety and soundness of the part. The review 
should, at a minimum, evaluate the following: 

• the adequacy of current and past manufacturing processes, including the ability 
of current and previous melt specifications and postweld procedures to protect 
against the creation of microstructural abnormalities; (A-98-30) 

• the propriety of using Ti-6242 titanium alloy, including the possible 
susceptibility of this alloy to the development of aberrant or undesirable 
crystallographic arrangements of alpha phase and a resulting vulnerability to 
rapid cracking; (A-98-31) and 

• the adequacy of the stress margins for the spool in the presence of an aberrant or 
undesirable microstructure. (A-98-32) 

Revise Airworthiness Directive 95-23-03, applicable to General Electric Aircraft 
Engines CF6-50, -80A, and -80C2 model engines, to include the -80E model 
engines, and to require repeated inspections of all high-pressure compressor rotor 
stage 3-9 spools at maximum intervals appropriately less than 4,000 cycles. (A-98- 
33) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA, and BLACK concurred in these recommendations. 
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On July 17, 1996, about 2031 eastern daylight time, a Boeing 747-131, N93119, operated 
as Trans World Airlines (TWA) flight 800, crashed into the Atlantic Ocean, about 8 miles south 
of East Moriches, New York, after taking off from John F. Kennedy International Airport, 
Jamaica, New York. All 230 people aboard the airplane were killed. The airplane, which was 
operated under Title 14 Code of Federal Regulations (CFR) Part 121, was bound for Charles De 
Gaulle International Airport, Paris, France. The flight data recorder and cockpit voice recorder 
ended simultaneously, about 12 minutes after takeoff. Evidence indicates that as the airplane 
was climbing near 13,800 feet mean sea level, an in-flight explosion occurred in the center wing 
fuel tank (CWT), which was nearly empty. 

The source of ignition of the CWT has not been determined, and the investigation into a 
variety of potential ignition sources continues. However, the Safety Board’s investigation has 
found damaged wiring in the fuel quantity indication systems (FQIS) 1 - 2 of the accident airplane 


1 The B-747 FQIS measures fuel quantity with a capacitance measurement fuel probe system in each fuel tank. 
There are seven capacitance measurement fuel probes in the B-747 CWT. Each fuel probe consists of an inner 
tubular element that is surrounded by an outer tube. Compensators, located near the low point of each fuel tank, are 
also constructed of assemblies of tubular elements. The compensators and probes have a hard plastic terminal block 
near the top of each to provide for wiring connections. Wires from each fuel probe and the compensator are routed 
within the fuel tank through nylon clips to a connector located at the rear wing spar and are exposed to fuel and 
vapor. 

2 Most of the B-747-100, -200, and -300 series airplanes (about 700 airplanes) are equipped with FQIS 
manufactured by Honeywell Corporation; airplanes equipped with the Honeywell system are the subject of this 
letter. About 10 percent of the B-747-100, -200, and -300 series fleet has been retrofitted with FQIS manufactured 
by BFGoodrich Aerospace Corporation (formerly Simmonds Precision). The B-747-400 series airplanes are 
equipped with the BFGoodrich system equipment. No BFGoodrich FQIS were inspected during the investigation. 
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and three retired B-747s: N93105 3 and N93117 4 and a former Air France airplane, F-BPVE, 5 and 
the Safety Board was informed of damaged FQIS wiring in a British Airways B-747, G-BBPU. 6 
These findings illustrate unsafe conditions that may exist in other B-747s and should be 
addressed by the Federal Aviation Administration (FAA). 

The potential hazardous features found inside of B-747 fuel tanks during the investigation 
include the following: 

1. FQIS wire insulation had been damaged near the attachment point of wires to 
four CWT fuel probe and compensator terminal blocks in N93105. 7 Terminal 
blocks with knurled (rough) areas on the surface had Honeywell Corporation 
manufacturing dates of November 1970 8 and earlier and were identified as 
Series 1, 2, and 3. 9 These terminal blocks had a metal strain relief clamp 
pressing the FQIS wires against the knurling. The knurled area consisted of a 
series of relatively sharp pointed cones in the hard plastic, and the edges of the 
terminal block castings transected the cones, thus creating sharp edges 
resembling saw teeth. The FQIS wire insulation had been cut by the knurled 
area, exposing the core conductors of some wires to the grounded shielding of 
others. 10 


3 N93105 had been undergoing maintenance when it was retired from service by TWA in 1994. The airplane had 
been in storage in Kansas City since that time. 

4 N93117 had been sold by TWA in 1992, and was subsequently placed in storage in Mojave, California, after 
77,145 flight hours. 

5 F-BPVE was retired by Air France in September 1994. The airplane was subsequently used by the Safety Board 
and other agencies for testing in Bruntingthorpe, England. 

6 G-BBPU is an in-service B-747-136. At the time of its inspection on November 1, 1996, the airplane had been 
operated 89,639 hours and 17,437 cycles since new. 

7 Few terminal blocks from N93119 were recovered and most of those were fragmented or otherwise damaged. 
Although few of the fragments had attached FQIS wires, chemical traces on the exterior of damaged wire insulation 
had been deposited on and around previously damaged surfaces. Damage similar to that found in N93105 has been 
seen in some FQIS components from F-BPVE. 

8 On May 28, 1969, Boeing implemented a requirement for the wires to withstand a 50-pound pull, and on 
December 29, 1969, Honeywell Engineering Change Order 69 15826 revised the design to a Series 4 terminal 
block, which deleted the use of screws to fasten FQIS wires to the terminal block and introduced the use of threaded 
studs and nuts. On the Series 4 block, the metal strain relief clamp and knurling were deleted and the FQIS wires 
were held within the eye of a “P”-shaped nylon clamp that held the wiring above the terminal block surface. The 
change order was to be effective as soon as new terminal blocks were available. Boeing reported that a production 
change was made at Boeing that installed the Series 4 terminal blocks in [airplane] line number 65 and onward. 
Since N93119 was line number 153 and was delivered on October 27, 1971, Boeing concluded that it was 
improbable that it was delivered with Series 3 terminal block probes. A mixture of terminal block series that 
included Series 1-3 and subsequent designs were found in each of the cited B-747 airplanes, including N93119. 

9 The Honeywell Component Maintenance Manual still shows the Series 1-3 terminal blocks and metal strain relief 
clamps as “applicable” [acceptable] for use. Honeywell has reportedly supplied them as replacement parts, although 
only the updated design is now sold. 

10 Wire shielding covers the inner insulation and core conductor with a layer of woven wire, which isolates the 
conductor from electromagnetic signals and provides protection to the inner insulation and core conductor from 
external mechanical damage. Additional insulation covers the wire shielding. 
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2. In addition to the knurled surfaces found in the Series 1-3 fuel probes, B-747 
fuel probe terminal blocks and compensators have squared edges that can 
damage wire insulation. A wire that had been located against the edge of a 
Series 1-3 terminal block from N93105 had a lengthwise cut in its insulation. 
(In contrast to the B-747 Series 1-3 terminal blocks, Honeywell also makes 
B-757 and B-767 fuel probes with terminal block edges that are smooth and 
rounded.) 

3. The insulation of a fuel probe wire from the CWT in N93105 was also found 
to be displaced (cold-flowed), exposing its core conductor. The wire had been 
one of several pressed under the strain relief clamp of a Series 1-3 fuel probe 
terminal block. Wire insulation was also displaced by cold-flow or chafe at 
points of tight contact between wires not under the knurled clamps and where 
wires were pressed against plastic heat-shrink material on adjacent wires, in 
some instances exposing the conductor of one wire to the shield of a second 
wire. Displaced insulation that had been damaged but not breached was 
identified at various locations where wires pressed against other wires, where 
wires were in contact with the edge of a clamp, and at the edges of nylon clips 
where the FQIS wire routing made sharp turns inside the fuel tanks. Points of 
chafing and potential chafing were also found where FQIS wires contacted 
structure in the CWT of N93117. 

4. During the accident investigation, two inappropriate repairs were found in the 
FQIS wiring in the wing tip fuel tanks of the accident airplane and another 
inappropriate repair was found by Boeing in a B-747 operated by another 
airline. The shielding of an N93119 wingtip tank FQIS probe wire had been 
previously broken and repaired. The repair of the wire consisted of splicing 
with a crimped connector and covering it with adhesive tape secured by wire 
bundle lacing tape. 11 Although the repair was functional, separated wire 
strands were found at the edge of the crimped connector. The separated 
strands had flat and angled-surface features, indicative of a fatigue failure. 
Boeing recommends that such broken FQIS wire be removed, solder-repaired, 
and covered with heat-shrink tubing. The second inappropriate repair found in 
N93119 was on a post-Series 3 compensator, where an oversized terminal 
block strain relief “P-clamp” had been used. The replacement P-clamp was 
larger than specified and unable to grip the FQIS wire harness. To provide 
strain relief, the wire harness had been looped to pass through the clamp twice 
and was still a loose fit. The third inappropriate repair was found in the CWT 


11 Wiring in B-747s is assembled into harnesses with lacing tape made of Dacron, fiberglass, or Nomex, as specified 
in the Boeing Standard Wiring Practices Manual, section 20-00-11, page 17, Table XX, “Tie Materials.” 


4 


of G-BBPU, where chafed FQIS wires had been repaired with fuel tank 
sealant. 12 

The damaged wiring at the terminal blocks was found only after the wiring had been 
removed. A close visual inspection in the tank without removing the wires would have been 
insufficient to disclose damage that is concealed between wires or under wire clamps. These 
types of damage could create spark gaps that are very small and that could become latent failures 
in the wiring system. 

Boeing issued Service Bulletin (SB) 747-28-2205 on June 27, 1997, and a notice of status 
change for this SB on September 25, 1997, to address B-747 fuel tank inspection procedures. 
However, the recommended inspection procedures for FQIS wires, fuel probes, and 
compensators were not addressed in sufficient depth for operators to find wire insulation damage 
similar to that found during the TWA 800 accident investigation. Most of the damaged FQIS 
wire insulation found during the accident investigation was concealed beneath strain relief 
clamps or other wires and was discovered only after the wiring was removed from terminal 
blocks. In some cases, the damage was not apparent until the ends of the wires were inspected 
under magnification. 

On October 27, 1997, Boeing issued a notice to B-747 operators (M-7220-97-1725) 
describing a planned SB that would provide further details on inspecting B-747 fuel probes, 
compensators, and FQIS wires. In an October 30, 1997, letter to the Safety Board, Boeing stated 
that the new SB will recommend the replacement of Series 1-3 fuel probes, the reporting of 
damage involving Series 4 and later fuel probes, the replacement of certain CWT FQIS wire 
harnesses, and the inspection for proper wire routing and existing damage; the SB will also 
establish an electrical resistance check of very low voltage and establish standards for FQIS 
repairs. 


The Safety Board appreciates Boeing’s efforts to develop a new SB to improve inspection 
of B-747 CWT FQIS components. However, compliance with SBs is not mandatory. The Safety 
Board believes that the FAA should issue, as soon as possible, an airworthiness directive (AD) to 
require a detailed inspection of FQIS wiring in B-747-100, -200, and -300 series airplane fuel 
tanks for damage, and the replacement or the repair of any wires found to be damaged. Wires on 
Honeywell Series 1-3 probes and compensators should be removed for examination. 

In December 1969, Boeing reportedly discontinued using the Honeywell Corporation 
Series 1-3 fuel probes (with knurled terminal block surfaces and metal strain relief clamps) and 
began using the Series 4 (and later) fuel probes 13 as a product improvement. However, the 
change was not considered mandatory and Series 1-3 fuel probes are still found in airplanes. 
This investigation has shown that the knurling and the sharp edges of the early design terminal 


12 The Boeing Standard Wiring Practices Manual describes methods and materials that can be used for wire repairs. 
It does not list fuel tank sealant as an approved material for repair of electrical wiring. 

13 See footnote 7. 




5 


blocks create damage to wire insulation. Changing to a Series 4 terminal block reduced the 
potential for FQIS wires to be damaged by the terminal blocks. However, the Honeywell 
overhaul manual still shows the Honeywell Series 1-3 terminal blocks as “applicable for use.” 
The Safety Board believes that the FAA should issue an AD to require the earliest possible 
replacement of the Honeywell Corporation Series 1-3 terminal blocks used on B-747 fuel probes 
with terminal blocks that do not have knurled surfaces or sharp edges that may damage FQIS 
wiring. 


Features of the fuel probes and wiring installation used in B-747s are similar to those of 
Honeywell fuel probes used in other airplanes, including the B-707, Lockheed C-130, B-757, and 
B-767. The B-707 and C-130 terminal blocks have a different shape but have some features 
similar to the B-747 design, including sharp edges. The B-757 and B-767 fuel probe terminal 
blocks have rounded edges and cast wire relief areas that are not used in the B-747 terminal 
blocks; the FQIS wires are retained in the cast wire relief areas by a flat metal bar. Wiring 
attached to the terminal blocks in airplanes other than the B-747 has not been examined by the 
Safety Board staff during the TWA 800 investigation. However, because of the similarities 
found during a review of fuel probe designs, the Safety Board is concerned that FQIS wiring 
problems discovered in this investigation may also exist in other airplanes with similar designs. 
Therefore, the Safety Board believes that the FAA should conduct a survey of FQIS probes and 
wires in B-747s equipped with systems other than Honeywell Series 1-3 probes and 
compensators and in other model airplanes that are used in 14 CFR Part 121 service to determine 
whether potential fuel tank ignition sources exist that are similar to those found in the B-747. 
The survey should include removing wires from fuel probes and examining the wires for damage. 
Repair or replacement procedures for any damaged wires that are found should be developed. 14 

Dark deposits were found around the wiring connections of fuel probes that had been 
removed from various fuel tanks in N93105, N93117, N93119, and F-BPVE. The deposits were 
found on wire insulation and on numerous plastic sleeves of crimped wire splices. A scanning 
electron microscope revealed that the dark deposits on N93119 and N93105 fuel probes 
contained copper, silver (silver-plated copper wiring is used in fuel tanks), and sulfur 
(a contaminant in jet fuel). The deposits on an N93119 FQIS compensator fragment were further 
examined at a U.S. Air Force research laboratory (Wright Laboratory) and were determined to be 
similar to copper sulfide deposits found in previous examinations of fuel probes from military 
aircraft. The laboratory had previously found that the deposits gradually reduced resistance 
between electrical connections of the military airplane fuel probes. 

Wright Laboratory staff received a fuel probe that had been removed from a military 
trainer and tested at a maintenance depot while the probe was still wet with fuel. The test 
involved voltage and current levels greater than those that would be available from the FQIS. 
According to the Wright Laboratory staff, disassembly of the probe revealed soot and carbonized 
copper-sulfide deposits, apparently from the ignition of fuel vapors. A report by the Wright 


14 Boeing is currently conducting a survey of Honeywell Series 4 probes and compensators. 
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Laboratory 15 states that a subsequent visual inspection found “discoloration and possible arcing 
on the bottom” of the probe. The report stated further, “It appears the internal probe wires were 
damaged by a fire. Evidence of an electrical arc was evident on the nylon cap which would have 
provided the required energy needed to ignite residual fuel.” Another fuel probe documented by 
the same set of reports had evidence of an arc-track 16 with deposits composed of copper sulfide 
and carbon. Unbumed deposits that were photographed by a scanning electron microscope had 
the appearance of flaking paint. Electronic testing for the resistance value of similar deposits on 
a third fuel probe revealed “small scintillating arcs” between the flakes, as current was increased 
to 5 milliamperes (voltage unknown) between a set of probes located 10 millimeters apart. When 
drops of JP-4 fuel were placed on the arcing deposit, the report said, “heat generated by the 
[electric] current rapidly evaporated the fuel. Resistance increased from 13,200 ohms to an open 
circuit (>20M) 17 after a few seconds.” The flaking copper sulfide deposits were found to be a 
brittle substance that clung tenaciously to plastic materials and could only be cleaned by 
mechanical abrasion. The report concluded the following: 

The residues act as a thin film resistor that will rupture and open if significant 
current is passed through the material. Residue formation is most likely the result 
of a long-term degradation or corrosion process. Exposed silver plated copper 
wiring and other silver containing surfaces (electrodes) are apparently reacting 
with the sulfur in the fuel. This deterioration process is most likely time 
dependent and, as the probes age, more probe [calibration] failures can be 
expected. 

Copper sulfide deposits were found inside the FQIS wire insulation of N93105 and 
N93119, where the wires had damaged insulation. The Safety Board is concerned that copper 
sulfide deposits on FQIS wires could become ignition sources in B-747 and similarly designed 
fuel tanks. The Safety Board believes that the FAA should require research into copper-sulfide 
deposits on FQIS parts in fuel tanks to determine the levels of deposits that may be hazardous, 
how to inspect and clean the deposits, and when to replace the components. 

The investigation has also found that although the design for the B-747 CWT FQIS 
provides for limited electrical power in the fuel tank, 18 the FQIS wires are routed in bundles with 
nearly 400 other wires, some of which carry up to 350 volts. 19 The FQIS harness routed between 


15 Wright Laboratory Report “Analysis of Trainer Aircraft Fuel Probes I,” dated March 1990, by George Slenski, 
Materials Integrity Branch, Systems Support Division, Materials Directorate. 

16 Arc-tracking is an insulation failure leading to flashover. Tracks develop along the discharge path on the surface 
of the insulation. The tracks are generally more conductive than the virgin insulation. These tracks carbonize 
quickly into significant conducting paths. 

17 Mega-ohms are one million ohms of electrical resistance. 

18 Power to the FQIS is limited by Boeing to 0.02 millijoules, or less than 10 percent of minimum ignition energy 
(MIE) required to ignite Jet A fuel under laboratory conditions, according to the American Petroleum Institute 
Recommended Practice 2003, Fifth Edition, December 1991, entitled “Protection Against Ignitions Arising out of 
Static, Lightning, and Stray Currents.” 

19 Zone A ceiling light wire W-1306-L1892-22 carries up to 350 volts. Numerous other wires carry 115 volts 
alternating current (VAC) and 28 volts direct current and are routed in bundles with FQIS system wires. Boeing 
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the CWT and the flight engineer’s panel in the cockpit contains one shielded wire and two 
unshielded wires in a woven fiberglass sleeve. Boeing noted in an October 27, 1997, letter that 
this is a common design for capacitive FQIS systems. Behind the flight engineer’s panel, the 
sleeved set of Teflon-insulated FQIS wires was connected to unprotected 20 general airplane 
wiring 21 that was routed to the fuel totalizer indicator and to the electrical/equipment (E/E) 
compartment located beneath the forward cabin and behind the nose landing gear. Additionally, 
unshielded Teflon wiring from the right wing fuel tanks was attached to a terminal strip located 
on spanwise beam No. 2 in the CWT, then was routed through the left wing fuel tanks to the 
ground refueling panel gauges located between the Nos. 1 and 2 engines. At the ground refueling 
panel, the fuel tank wiring was routed with other aircraft wiring for the refueling indicators and 
controls. 

Electrical short circuits can introduce high voltage into low voltage conductors. For 
example, it was determined that a military C-130 fuel tank exploded in the 1970s after improper 
maintenance had created a short circuit within a fuel gauge electrical connector. 22 Maintenance 
work on the connector was not finished before the flight, and the investigation found that 115 
VAC power was inadvertently allowed to enter the fuel tank through the shielding of FQIS wires. 

In the investigation of a May 11, 1990, Philippine Airlines B-737-300 CWT explosion at 
Ninoy Aquino International Airport, Manila, Philippines, the exact source of ignition was never 
established. However, the Safety Board later concluded, “It is possible that the combination of a 
faulty float switch and damaged wires providing a continuous power supply to the float switch 
may have caused an electrical arc or overheating of the switch leading to the ignition of the 
center fuel tank vapor.” 23 

An Air Force study 24 of data from 1986 to 1989 mishaps 25 caused by electrical failures 
found 652 records, of which 326 were examined in detail. Of the 326 reports, 49 involved 
“conductors” (typically aircraft wiring) and 51 involved “connectors” of numerous types. The 
study concluded the following: 


RA164 Center Wing Tank Wire Bundle Analysis Report, December 17, 1996, indicates bundle No. W186 contains 
12 192-volt wires for the flight engineer panel lighting. 

20 Wires that were not isolated or shielded and that were routed in bundles with other wires, some of which carried 
power for other airplane systems. 

21 Wire markings identified the general N93119 aircraft wiring as (Boeing Specification) BMS13-42A, marketed by 
Raychem. The wire was sold commercially under the trade name “Poly-X.” Other types of wire were also used in 
the construction of B-747 airplanes. 

22 The Safety Board was permitted to review a report regarding a military C-130 fuel tank explosion that occurred 
after improper maintenance created a short circuit that created an ignition source in the fuel tank. The airplane 
identification and the date and location of the incident have not been released. 

23 National Transportation Safety Board. August 1, 1990. Safety Recommendations A-90-100 through -103. 

24 Contract F33615-89-C-5647, completed January 1989, to develop a handbook for the evaluation of electrical 
components in aircraft accident investigations. 

25 According to the Air Force, there are four classes of mishaps in the Norton database [of USAF mishaps]. Classes 
A, B, and C generally represent in-flight conditions that result in some damage to the aircraft. The fourth class 
includes potential mishaps, which may be the result of unusual conditions observed during maintenance or preflight 
checks. 
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The majority of aircraft mishaps involving electronics are related to 
interconnection problems. Interconnection problems are primarily due to wiring 
and connector failures. Chafing, which results in electrical arcing of wiring, and 
corrosion, which results in the electrical breakdown in connectors, appear to be 
the dominate failure mechanisms. 

Such findings are not unique to military mishaps. For example, on July 19, 1997, a 
Lufthansa B-747 freighter (D-ABZC) was on final approach to JFK International Airport, New 
York, when seven circuit breakers popped in the cockpit. Afterward, maintenance personnel 
found 47 (non-FQIS) wires burned in more than 8 inches of the affected wire bundle; the wires 
were located beneath the oxygen bottles in the “cheek” area to the right of the forward cargo 
compartment. The wires led to the leading and trailing edge flaps, landing gear circuitry, and the 
anticollision lights. Circuitry for the wing flap asymmetry detection and a flap electrical drive 
motor led to the burned area, and each of those components needed replacement. The airplane 
had been purchased from another carrier and, in April 1993, was modified by a third company to 
the freighter configuration. Lufthansa found that this airplane and five others that were modified 
by the same company had metal drill shavings and other debris in that area of the wire bundle. 
The incident demonstrated the danger of allowing metal shavings to remain on wiring and the 
possibility of introducing enough electrical energy into unrelated circuits to damage electrical 
components. 

In addition to investigating the potential for introducing energy into FQIS wires from 
direct short circuits, tests were conducted to determine the energy that can be induced into 
unshielded FQIS wires by electromagnetic inductance (EMI). Laboratory tests 26 have shown that 
EMI can introduce elevated levels of energy into FQIS wiring, and sparks can be induced by 
adding foreign material to the fuel probes, thus creating spark gaps. This amount of energy was 
only found during tests in which a spark gap was artificially created between the Lo-Z (outer fuel 
probe electrode or terminal) and ground. To date, testing has not duplicated those results on an 
airplane. The investigation of this issue is continuing. 

Wire shielding and physical separation each provide EMI and chafe protection for the 
inner conductor and a path to ground for short circuits from other wires and are widely used in 
airplanes. However, two of the three recovered FQIS wires from N93119 that had been routed 
between the CWT and the cockpit in a woven sleeve were not protected from EMI or chafing by 
shielding or separation from other wires. Also, BMS13-42A wires that were found routed from 
the cockpit end of the FQIS harness to the E/E compartment were not shielded or separated. In 
1974, Boeing incorporated an overall shield around all three CWT FQIS wires routed between 
the CWT and flight engineer panel; in 1980, Boeing added further shielding to FQIS wires 
behind the flight engineer panel. However, these wiring changes were not required for 
previously manufactured airplanes, such as N93119. In its October 27, 1997, letter, Boeing 


26 Tests were conducted to Boeing specification to create transient voltages and sparks by switching electrical 
power on and off in wires that had been laid parallel to the CWT bundle. Tests induced up to 0.060 millijoules of 
energy in the CWT harness, exceeding the API practice 2003 reference for an MIE requirement of 0.025 millijoules. 
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acknowledged the additional benefits of shielding, but wrote that the shielded wire was used to 
correct for electrical noise in the FQIS wires (not for EMI or chafe protection). 

The Safety Board recognizes the difficulty and expense associated with physically 
separating FQIS wires from other wires and adding shielding to FQIS wires on in-service air 
carrier airplanes. Access is limited behind avionic racks and at bulkhead electrical connectors, 
and rewiring is labor intensive. However, the separation of the FQIS from other power sources 
by shielding and separation can protect fuel tank wires from power sources that can potentially 
ignite an explosive vapor in a fuel tank. The Safety Board believes that the FAA should require 
in B-747 airplanes, and in other airplanes with FQIS wire installations that are corouted with 
wires that may be powered, the physical separation and electrical shielding of FQIS wires to the 
maximum extent possible. 

Because of the variety of latent potential ignition sources found in B-747 fuel tanks, and 
the variety of means by which energy can be introduced into FQIS wires, the Safety Board does 
not believe that correcting wiring deficiencies and addressing system failures would fully protect 
the B-747 CWT and other fuel tanks against all potential ignition sources. Total FQIS wire 
shielding or separation from other wires would be very difficult to change in airplanes already in 
service and would not address failures within system components, such as fuel gauges, ground 
refueling volumetric shutoffs, and data acquisition units. Unless the volatility of fuel tank vapors 
can be eliminated as a potential hazard, electrical power surge suppressers may be the most 
effective method of preventing the FQIS from becoming an ignition source. On December 1, 
1997, the FAA issued a notice of proposed rulemaking applicable to B-747-100, -200, and -300 
series airplanes that agreed with this premise and would require either the installation of 
components for the suppression of electrical transients by electromagnetic interference, or the 
shielding and separation of the electrical wiring of the FQIS. 

Surge suppressors installed where FQIS wires enter fuel tanks could provide added 
protection against excessive power surges in the FQIS system, regardless of origin. Surge 
protection systems are used in a range of devices, from autopilots to personal computers. Boeing 
has successfully used electrical surge suppression in other applications, but has noted that 
extreme care would have to be used in an FQIS application to account for possible influences on 
system operation and failure modes. Because the basic concepts of most capacitance FQIS 
systems are similar, the Safety Board believes that the FAA should require, in all applicable 
transport airplane fuel tanks, surge protection systems to prevent electrical power surges from 
entering fuel tanks through FQIS wires. 

Therefore, the National Transportation Safety Board recommends that the Federal 
Aviation Administration: 

Issue, as soon as possible, an airworthiness directive to require a detailed 

inspection of fuel quantity indication system wiring in Boeing 747-100, -200, and 

-300 series airplane fuel tanks for damage, and the replacement or the repair of 
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any wires found to be damaged. Wires on Honeywell Series 1-3 probes and 
compensators should be removed for examination. (A-98-34) 

Issue an airworthiness directive to require the earliest possible replacement of the 
Honeywell Corporation Series 1-3 terminal blocks used on Boeing 747 fuel 
probes with terminal blocks that do not have knurled surfaces or sharp edges that 
may damage fuel quantity indication system wiring. (A-98-35) 

Conduct a survey of fuel quantity indication system probes and wires in Boeing 
747s equipped with systems other than Honeywell Series 1-3 probes and 
compensators and in other model airplanes that are used in Title 14 Code of 
Federal Regulations Part 121 service to determine whether potential fuel tank 
ignition sources exist that are similar to those found in the Boeing 747. The 
survey should include removing wires from fuel probes and examining the wires 
for damage. Repair or replacement procedures for any damaged wires that are 
found should be developed. (A-98-36) 

Require research into copper-sulfide deposits on fuel quantity indication system 
parts in fuel tanks to determine the levels of deposits that may be hazardous, how 
to inspect and clean the deposits, and when to replace the components. (A-98-37) 

Require in Boeing 747 airplanes, and in other airplanes with fuel quantity 
indication system (FQIS) wire installations that are corouted with wires that may 
be powered, the physical separation and electrical shielding of FQIS wires to the 
maximum extent possible. (A-98-38) 

Require, in all applicable transport airplane fuel tanks, surge protection systems to 
prevent electrical power surges from entering fuel tanks though fuel quantity 
indication system wires. (A-98-39) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMDDT, 
GOGLIA, and BLACK concurred in these recommendations. 




National Transportation Safety Board 

Washington, D.C. 20594 

Safety Recommendation 


Date: March 17, 1998 
In reply refer to: A-98-40 


Honorable Jane F. Garvey 
Administrator 

Federal Aviation Administration 
Washington, D.C. 20591 


On June 17, 1997, just after takeoff from Las Vegas, Nevada, a Reno Air McDonnell 
Douglas MD-83 airplane, N875RA, operating as flight 516, experienced an uncontained failure of 
the No. 1 (left) engine, a Pratt & Whitney (P&W) JT8D-219, serial number (SN) 708177. The 
airplane returned to Las Vegas and landed without further incident. The airplane was operating 
on an instrument flight rules flight plan under the provisions of Title 14 Code of Federal 
Regulations Part 121 as a regularly scheduled passenger flight from Las Vegas to Colorado 
Springs, Colorado. The investigation of this incident is continuing; however, information 
gathered thus far raises safety concerns that the National Transportation Safety Board believes 
require Federal Aviation Administration (FAA) action. 

During the aircraft’s ascent after takeoff, high-pressure turbine (HPT) parts were liberated 
from the engine. Inspection of the airplane revealed two exit holes in the engine nacelle and one 
hole in the ftiselage in a nonpressurized compartment of the airplane. Postincident examination of 
the engine revealed four exit holes in the combustion chamber fan ducts just forward of the HPT 
rotational plane, yet the HPT case (front turbine case) was not penetrated. Two sections of the 
HPT case rear flange were bent outward and forward, and were disengaged from the low- 
pressure turbine (LPT) case (rear turbine case) front flange, creating two large openings. The 
HPT shaft had sheared at the No. 4 'A-bearing scavenge oil holes; all the HPT blades fractured 
transversely across the blade airfoil; and all the 2 nd -stage turbine vanes were missing. 

The engine was equipped with an HPT containment shield (see figure 1) as required by 
Airworthiness Directive (AD) 93-23-10. 1 The AD was issued on January 18, 1994, and is 


1 The containment shield is intended to prevent engine HPT parts from being liberated and causing secondary 
Hamagft to the airplane or injuring passengers. The shield is positioned radially outward from the rotational plane 
of the HPT blades. The width of the containment shield is approximately 4 inches, and its support attaches to the 
HPT case rear flange. The support, although it provides some containment capability, is primarily to buttress and 
properly position the containment shield. 


6946 
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applicable to all JT8D-209, -217, -217A, -217C, and -219 turbofan engines. The containment 
shield is a clam shell design consisting of two half-shields joined by clevis plates and supported by 
a cantilevered shield support attached to the HPT rear flange. Considerable impact damage 
(engine debris) was observed on the inner diameter (ID) of the containment shield; however, the 
shield remained intact. The impact of turbine material on the lower shield shifted it outward and 
aft from its normal installed position, buckling its support. First-stage turbine blades and 2 nd -stage 
turbine vanes had exited the engine through the openings between the HPT and LPT case flanges 
and deflected off the containment shield ID while exiting the engine and before striking the 
airframe. 



Containment Shield 


Rear Turbine Case 


Turbine Fan Duct Segment 


Containment Shield Support 


Figure 1 Containment Shield Configuration 


Another incident involving a P&W JT8D-219 uncontained turbine failure that resulted 
from a sheared HPT shaft occurred on July 13, 1996, on a Centennial Airlines 2 McDonnell 
Douglas MD-80 airplane, en route from Dusseldorf, Germany, to the Canary Islands. Like the 
Reno Air incident, the failed engine was equipped with an HPT containment shield, which was not 


2 Centennial Airlines is a Spanish-registered supplemental air carrier based in Palma de Mallorca, Spain. 
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penetrated; however, exiting turbine parts impacted the shield ID, buckled its support, and shifted 
the shield from its normal position. The buckled support allowed the exiting turbine parts to 
deflect off the shield and penetrate the engine nacelle. 

On November 7, 1991, after the JT8D-200 series engine had experienced six HPT shaft 
fractures, three resulting in the liberation of turbine parts, P&W issued Alert Service Bulletin 
(ASB) 6053 to incorporate a containment shield for JT8D-209, -217, 217A, -217C, and -219 
engines. 3 Subsequently, P&W issued Service Bulletin (SB) 6122 on May 20, 1993, to address 
premature wear of the support slip joint caused by buffeting of the shield. The basic design stayed 
the same; however, new hardware with hardfacing 4 on the mating surfaces was incorporated. AD 
93-23-10 required JT8D-200 series engines to be outfitted with a containment shield as instructed 
by P&W ASB 6053, Revision 7, dated May 24, 1993. The FAA’s Engine Certification Manager, 
ANE-140, issued a letter on June 28, 1994, approving SB 6122 as an equivalent means of 
compliance to AD 93-23-10. 

The Reno Air and Centennial Airlines incidents have shown that the JT8D-200 series 
engine HPT containment shield design is inadequate to prevent all turbine parts from being 
liberated because the support is insufficient to sustain the shield in the proper location when 
impacted by some exiting turbine material. In addition, the incidents have shown that the 
containment shield is not wide enough nor the sidewalls deep enough to ensure that exiting 
material will be contained under a variety of exit paths. The Safety Board is concerned that the 
current containment shield cannot prevent HPT part liberation and therefore believes that the 
FAA should evaluate the current P&W JT8D-200 series engine HPT containment shield required 
by AD 93-23-10 and, if shown by evaluation, require that it be replaced with an HPT containment 
shield that would provide a larger coverage area and more impact resistance and durability. 

Therefore, as a result of the ongoing investigation of this incident, the National 
Transportation Safety Board recommends that the Federal Aviation Administration: 

Evaluate the current Pratt & Whitney JT8D-200 series engine high-pressure 
turbine (HPT) containment shield required by Airworthiness Directive 93-23-10 
and, if shown by evaluation, require that it be replaced with an HPT containment 
shield that would provide a larger coverage area and more impact resistance and 
durability. (A-98-40) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA, and BLACK concurred in this recommendation. 


3 At the time ASB 6053 was issued there had been six documented HPT fractures resulting from No. 4 and 5 
bearing compartment oil fires, three of which have resulted in uncontained events. 

4 Hardface is a seal facing of high hardness that is applied to a softer material, such as by flame spraying, plasma 
spraying, electroplating, nitriding, carburizing, or welding for better wear resistance. 
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National Transportation Safety Board 

Washington, D.C. 20594 

Safety Recommendation 


Date: June 25, 1998 

In reply refer to: A-98-41 through -42 


Honorable Jane F. Garvey 
Administrator 

Federal Aviation Administration 
Washington, D.C. 20591 


On April 28, 1997, at 1222 mountain standard time, American Airlines flight 230, a 
McDonnell Douglas MD-82, sustained a left engine turbine section fire and tailpipe fire shortly 
after takeoff from the Tucson International Airport, Tucson, Arizona. The flight was operating in 
visual flight rules conditions under Tide 14 Code of Federal Regulations (CFR) Part 121 as a 
scheduled domestic passenger flight from Tucson to Dallas-Fort Worth, Texas. e 
crewmembers and 118 passengers sustained no injuries. 

The captain stated that he heard a loud bang as the aircraft was climbing through 1,800 
feet, and the left engine “spooled down.” A left engine fire extinguisher bottle was activated to 
control the fire, and the engine was secured. The flight returned and landed on runway 29R. As 
airport rescue and firefighting (ARFF) personnel extinguished a fire in the left engine tailpipe, 
the flightcrew attempted to contact them on the ground control frequency. By the time radio 
contact was made, approximately 16 passengers had exited the aircraft via the forward left door 
slide, and several other passengers had climbed onto the right wing to evacuate. The flight 
attendant stated that she saw firetrucks and firemen outside the cabin door and one fireman “gave 
me the thumbs up, then I proceeded to open the door.” The firefighter stated that he gave the 
“thumbs up” hand signal to stop the evacuation. The ARFF personnel stopped the passengers 
from evacuating the aircraft and directed them back inside the airplane. The remaining 
passengers eventually deplaned using portable stairs. 

During a debriefing session of the incident, ARFF personnel determined that the 
evacuation of this aircraft was not necessary and that the aircraft could have been safely towe dJo 
a gate. The passengers could have safely deplaned at that point. During the discussions, ARFF 
personnel stated that if they had a direct means of communicating with the flightcrew, 
unnecessary evacuations such as this one could be avoided. 

On July 8, 1996, about 0741 central daylight time. Southwest Airlines flight 436, a 
Boeing 737-200, N53SW, received minor damage during a rejected takeoff (RTO) from runway 
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20C at the Nashville Metropolitan Airport, Nashville, Tennessee. The airplane was operated as a 
regularly scheduled domestic passenger flight under the provisions of 14 CFR Part 121. The 
airplane stopped approximately 750 feet off the departure end of runway 20C, about 100 feet east 
of the extended centerline. The 5 crewmembers and 122 passengers evacuated using the 
emergency slides. One passenger received serious injuries, and four passengers received minor 
injuries during the emergency evacuation. 

After completing the emergency checklist and announcing over the public address system 
that the passengers should remain seated, the captain saw that the fire department equipment had 
arrived. The captain and the ARFF on-scene supervisor established voice communications 
through the captain’s open cockpit window. The ARFF supervisor reported to the captain that 
the tires were smoking and deflating. The right main landing gear ignited and was immediately 
extinguished with foam. After hearing a fire warning and without determining the location or 
severity of the fire, the flight attendants initiated an aircraft evacuation. During the evacuation, 
the left main landing gear ignited and was immediately extinguished. Although the flightcrew 
was able to communicate with the ARFF personnel through the open cockpit window, the 
Nashville Metropolitan Airport Authority determined that a designated radio frequency might 
have allowed the ARFF personnel to advise the flightcrew about the situation in a more timely 
manner. Therefore, the flightcrew might have been able to coordinate with the flight attendants 
and prevent an evacuation. As a result of this accident, a designated frequency was assigned for 
use during accidents and incidents at the Nashville airport. 

Eight major airports in the United States have instituted a designated frequency for 
emergency use. 1 On June 19, 1996, Delta Air Lines flight 229, a Boeing 767-332, returned to the 
Salt Lake City Airport, Salt Lake City, Utah, after the flightcrew detected a fire in the right 
engine; although the fire was still burning, ARFF personnel and the flightcrew decided not to 
evacuate the airplane while ARFF members extinguished the fire. Although before this incident 
the Salt Lake City Airport did not have a designated frequency, the ground controller provided 
the flightcrew and ARFF personnel a discrete frequency on which to communicate that resulted 
in improved emergency response. The flightcrew was able to taxi the aircraft to a gate under the 
airplane’s own power. The passengers and crew sustained no injuries. 

The Tucson and Nashville incidents illustrate the need for flightcrews and ARFF 
personnel to have the ability to communicate with each other directly. A designated radio 
frequency allows ARFF personnel to issue critical information concerning the exact nature of, 
and hazards associated with, an emergency in progress. Consequently, the Safety Board believes 
that the FAA should establish a designated radio frequency at all airports certified under Title 
14 CFR Part 139 that allows direct communication between ARFF personnel and flightcrew 
members in the event of an emergency and take appropriate measures to ensure that air traffic 
control personnel, ARFF personnel, and pilots are aware of its designation. 


1 The airports are located in Covington/Cincinnati, Ohio (CVG); Honolulu, Hawaii (HNL); Seattle, Washington 
(SEA); Nashville, Tennessee (BNA); Los Angeles, California (LAX); Fort Lauderdale, Florida (FLL); Philadelphia, 
Pennsylvania (PHL); and Boston, Massachusetts (BOS). 
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The Safety Board is also concerned that ARFF personnel may not be able to communicate 
with a flightcrew if power is lost or if the flightcrew must abandon the cockpit. Following RTOs 
and emergency landings, flightcrews may shutdown the airplane’s electrical power, rendering 
two-way radio communications ineffective. Consequently, the Safety Board believes that the 
FAA should develop a universal set of hand signals for use between ARFF personnel and 
flightcrews and flight attendants for situations in which radio communication is lost. 

Therefore, the National Transportation Safety Board recommends that the Federal 
Aviation Administration: 

Establish a designated radio frequency at all airports certified under Title 14 CFR 
Part 139 that allows direct communication between airport rescue and firefighting 
(ARFF) personnel and flightcrew members in the event of an emergency and take 
appropriate measures to ensure that air traffic control personnel, ARFF personnel, 
and pilots are aware of its designation. (A-98-41) 

Develop a universal set of hand signals for use between airport rescue and 
firefighting personnel and flightcrews and flight attendants for situations in which 
radio communication is lost. (A-98-42) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA, and BLACK concurred in these recommendations. 

By: / Jim Hjdl 




National Transportation Safety Board 

Washington, D.C. 20594 

Safety Recommendation 


Date: June 25, 1998 
In reply refer to: A-98-43 


Honorable Jane F. Garvey 
Administrator 

Federal Aviation Administration 
Washington, D.C. 20591 

On December 26, 1995, a Piper PA-46-310P, N800SJ, lost engine power during cruise 
flight and crashed at Ocala, Florida, while attempting to perform an emergency landing. 1 The 
pilot and one of the passengers were seriously injured. The National Transportation Safety 
Board’s examination of the engine disclosed detonation damage to the No. 6 cylinder piston and 
scoring of the piston sidewalls at five of the six cylinders. The engine turbocharger’s turbine-inlet 
temperature (T.I.T.) gauge was tested and found to read low; at the 1,750°F test point (maximum 
continuous T.I.T.), the gauge indicated only about 1,640°F. 

The Safety Board determined that the probable cause of the accident was “oil starvation 
resulting in connecting rod failure in three of the six cylinders due to lack of lubrication. At the 
request of the Safety Board, maintenance personnel checked the calibration of T.I.T. gauges in 
nine PA-46 series airplanes (seven PA-46-350P models and two PA-46-310P models). Three of 
the gauges indicated correctly at the 1,750°F test point; the other gauges indicated 60° to 110° 
low. 

On April 26, 1996, Piper issued Service Bulletin (SB) No. 995A, “Turbine Inlet 
Temperature (T.I T.) System Calibration and Probe Replacement.” Under “PURPOSE” the 
bulletin states the following: 

Field reports indicate that the accuracy of the existing [T.I.T.] probe may decrease 
over time in service. The corrosive and very hostile environment experienced in 
the exhaust system has dictated that Piper establish a 250 hour service life for the 
T.I.T. probe. In addition, a new calibration procedure has been established to 
check the accuracy of the indicator and wiring. Failure to calibrate the T.I.T. 
system or to replace the T.I.T. probe as prescribed, may lead to inaccurate or 
erroneous T.I.T. indications, and possible engine damage. 


1 For more detailed information, read Brief of Accident MIA96FA049 (enclosed). 
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This Service Bulletin consists of two (2) PARTS which address the T.I.T. system: 

PART I provides for the application of a new calibration procedure for the T.I.T. 
system (one time). 

PART 11 requires an initial replacement of the T.I.T. probe at the compliance time 
listed above and requires repetitive replacement by establishing a normal service 
life. (On PA-46-350P aircraft only.) 

Failure to comply with this Service Bulletin may result in damage to or shorten the 
life of the powerplant. Compliance must occur at or within the compliance times 
indicated. 


The calibration procedure is applicable to Lewis T.I.T. gauges, Piper Part Number 
471-008 or 548-011 and is required each time a T.I.T. gauge is replaced or if a system error is 
suspected. SB 995A indicates that T.I.T. probe replacement must occur at cylinder changes, at 
engine overhauls, or if other T.I.T. system maladies become apparent. 

The PA-46-310P Pilot’s Operating Handbook (POH) indicates that the airplane’s cruise 
fuel mixture setting should be established at 50° lean of peak T.I.T. The POH outlines a 
procedure for doing so and indicates that although the procedure differs from conventional 
leaning procedures, the airplane should never be operated in cruise with a fuel mixture setting 
other than 50° lean of peak T.I.T. The POH contains the following precautionary note in 
connection with establishing the peak T.I.T.: 


Maximum continuous T.I.T. is 1750°F. Temporary operation up to 1800°F is 
permitted in order to define peak T.I.T. In no case should the aircraft be operated 
more than 30 seconds with a T.I.T. in excess of 1750°F. 

The Safety Board agrees with the importance of adhering to Piper’s cruise fuel mixture 
setting procedure. However, in view of the accident involving N800SJ and the critical importance 
of adhering to the engine turbocharger’s T.I.T. limitation, the Safety Board is concerned that use 
of inaccurate T.I.T. gauges to define the peak T.I.T. may result in or contribute to inadvertent 
engine damage and an in-flight loss of power. Therefore, the Safety Board believes that the FAA 
should issue an airworthiness directive, applicable to both Piper PA-46-31 OP and PA-46-350P 
model airplanes, requiring compliance with Piper SB 995A, “Turbine Inlet Temperature (T.I.T.) 
System Calibration and Probe Replacement.” 


Therefore, the National Transportation Safety Board recommends that the Federal 
Aviation Administration: 
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Issue an airworthiness directive, applicable to both Piper PA-46-31 OP and 
PA-46-350P model airplanes, requiring compliance with Piper Service Bulletin No. 
995A, “Turbine Inlet Temperature (T.I.T.) System Calibration and Probe 
Replacement.” (A-98-43) 


Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA, and BLACK concurred in this recommendation. 


By: ^igHalf 
Chairman 
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National Transportation Safety Board 

Washington, D.C. 20594 

Safety Recommendation 


Date: July 10, 1998 

In reply refer to: A-98-44 through -58 


Honorable Jane F. Garvey 
Administrator 

Federal Aviation Administration 
Washington, D.C. 20591 


On August 7, 1997, at 1236 eastern daylight time, 1 a Douglas 2 DC-8-61, N27UA, 
operated by Fine Airlines Inc. (Fine Air) as flight 101, crashed after takeoff from runway 27R at 
Miami International Airport (MIA) in Miami, Florida. The three flightcrew members and one 
security guard on board were killed, and a motorist was killed on the ground. The airplane was 
destroyed by impact and a postcrash fire. The cargo flight, with a scheduled destination of Santo 
Domingo, Dominican Republic, was conducted on an instrument flight rules flight plan and 
operated under Tide 14 Code of Federal Regulations (CFR) Part 121 as a Supplemental air 
carrier. 


The National Transportation Safety Board determines that the probable cause of the 
accident, which resulted from the airplane being misloaded to produce a more aft center of 
gravity and a correspondingly incorrect stabilizer trim setting that precipitated an extreme 
pitch-up at rotation, was (1) the failure of Fine Air to exercise operational control over the cargo 
loading process; and (2) the failure of Aeromar to load the airplane as specified by Fine Air. 
Contributing to the accident was the failure of the Federal Aviation Administration (FAA) to 
adequately monitor Fine Air’s operational control responsibilities for cargo loading and the 
failure of the FAA to ensure that known cargo-related deficiencies were corrected at Fine Air. 3 

Accident Scenario 

The airplane departed controlled flight shortly after rotation, following an apparently 
normal taxi and takeoff roll. The Safety Board’s correlation of data from the flight data recorder 
(FDR) and cockpit voice recorder (CVR) determined that the stick shaker warning activated 


1 Unless otherwise indicated, all times are eastern daylight time, based on a 24-hour clock. 

2 Boeing Commercial Airplane Group acquired the holdings of the Douglas Aircraft Company and 
McDonnell Douglas in 1997. 

3 National Transportation Safety Board. 1998. Uncontrolled Impact With Terrain, Fine Airlines Flight 
101, Douglas DC-8-61, N27UA, Miami, Florida, August 7, 1997. Aircraft Accident Report NTSB/AAR-98/02. 
Washington. DC. 
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when the airplane was at an altitude of about 100 feet msl. According to the Board’s performance 
study of the airplane’s motion during the accident sequence, about 16 seconds after the start of 
rotation, at an altitude of about 300 feet msl, the airplane reached an extremely nose-high pitch 
attitude in the range of 30° and an angle-of-attack (AOA) approaching 20°, which resulted in an 
aerodynamic stall (an AOA of 15° was sufficient to bring the airplane into the stall region). 
Subsequently, the AOA decreased toward 10°, and the pitch decreased to below 20°, resulting in 
a brief recovery from the stall, followed by another AOA increase into the stall region 5 seconds 
later (the stall warning stopped at 12:36:12 and resumed at 12:36:17). 

The ground scars and the airplane damage indicated that at impact, the pitch angle was 
about 23°, while the flight path angle was about 26° down. This resulted in an AOA of at least 
49° at the time of impact, consistent with the airplane being in a deep stall. A continued stall is 
also consistent with the stick shaker stall warning and engine surge sounds recorded on the CVR 
in the final moments of the flight and the witness statements about pitch attitude during flight 
and at ground impact. The performance study showed that once the initial stall was reached, full 
recovery was unlikely because of the airplane’s low altitude and the airplane’s rapidly decreasing 
performance. Thus, based on analysis of FDR, CVR, and postaccident airplane performance data 
and on witness statements, the Safety Board concludes that the airplane pitched up quickly into a 
stall, that it recovered briefly from the stall, that it stalled again, and that recovery before ground 
impact was unlikely once the stall series began. 

Airplane Handling Characteristics 

The weight and balance form provided to the flightcrew showed a calculated center of 
gravity (CG) location at 30.0 percent mean aerodynamic cord (MAC). However, the Safety 
Board and the Douglas Products Division calculated a CG of 32.8 percent MAC based on a 
loading scenario developed from information provided by Aeromar loaders, Fine Air flight 
follower testimony, pallet weight documentation, and postaccident communication with Aeromar 
representatives. The Safety Board also notes that a relatively small addition to and/or 
redistribution of cargo could have moved the airplane’s CG beyond the aft limit of 33.1 percent 
MAC. 


The succession of errors made by Fine Air and Aeromar in loading this flight and the 
deficiencies in the Aeromar and Fine Air loading procedures identified during postaccident FAA 
inspections made it impossible to precisely determine the weight and CG from the data that were 
available following the accident. For example, the cargo destined for the accident airplane was 
listed as weighing 89,719 pounds when it arrived at Aeromar’s warehouse in big pacs and boxes. 
After being put on pallets and secured with plastic covers and netting, the cargo was listed on the 
Aeromar pallet load sheet as weighing 88,923 pounds, or 796 pounds less than the cargo weighed 
at arrival. Pallets and netting added an additional 275 pounds per pallet (or about 4,400 pounds to 
the total cargo weight). Based on postaccident Aeromar statements that the entire cargo 
delivered to Aeromar was loaded onto pallets for shipment on the accident airplane, the actual 
cargo weight could have been at least 94,119 pounds. Thus, the weight of the cargo that Aeromar 
provided to Fine Air could have been 5,196 pounds more than listed on the pallet weight form 
(which resulted in the CG of 32.8 percent MAC). This additional weight could have had a 
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significant effect on the CG of the airplane, depending on how it was distributed through the 
cabin. 4 


In February 1998, the Safety Board conducted a series of tests using a DC-8 full motion 
flight training simulator. Multiple takeoff attempts were simulated using aircraft weight, flap 
settings, and thrust values equivalent to the accident conditions and a range of CG values. The 
simulator flight tests suggest that at 33 percent MAC, the column inputs recorded on the accident 
airplane’s FDR might have been sufficient to prevent the pitch-up and stall. Further, at 35 
percent MAC, the simulator reached the stall condition more quickly than did the accident 
airplane. Although adequate control power existed from the elevators and pitch trim to recover 
the airplane at 35 percent MAC, successful recovery required an immediate and aggressive 
control input response (full forward column, which could be assisted by nose-down trim). Pilots 
involved in the simulation reported that their immediate control inputs were successful for the 
conditions tested because they were anticipating the pitch-up at rotation. 5 At CG values aft of 35 
percent, the airplane was increasingly subject to autorotation tendencies well before rotation 
speed and to tail strike on the runway, which did not occur during the accident. However, based 
on the loading information and the simulator tests, the Safety Board concludes that the CG of the 
accident airplane was near or even aft of the airplane’s aft CG limit. 

Statements by the flightcrew on the CVR show that the stabilizer trim was set during taxi- 
out at 2.4 units ANU, the value appropriate for the trim setting and CG of 30 percent MAC that 
the flightcrew had been given. The number of trim-in-motion tones recorded on the CVR during 
the recovery attempt and the full-nose-down trim setting found at impact were also consistent 
with the flightcrew having s6t 2.4 units during taxi. 

The Safety Board considered the effects of different aircraft loadings on CG location and 
the associated pitch trim settings. The investigation found that 13 pallets had been moved farther 
aft than indicated on the loading sheet At 88,923 pounds total cargo weight, moving the 13 
pallets aft (and turning pallet four 90°) would have shifted the CG from 24.0 percent MAC 
(requiring 5.4 units airplane nose up [ANU] pitch trim) to 32.4 percent MAC (1.0 units ANU). 
Further, if the cargo weight were 94,119 pounds, the CG would have shifted from 24.0 percent 
MAC (5.4 units ANU) to 32.8 percent MAC (0.9 units ANU). Thus, pushing the 13 pallets aft 
shifted the CG farther aft by at least 8 percent MAC. Further, because the accident airplane’s 
stabilizer trim setting was 2.4 units ANU, the Safety Board concludes that the CG shift resulted 
in the airplane’s trim being mis-set by at least 1.5 units ANU (2.4 minus 0.9 units at 94,119 
pounds). 


4 Based on a payload weight of 94,119 pounds, the Safety Board calculated that the redistribution of 250 
pounds from the front to the rear of the airplane could have resulted in a CG of 33.2 percent MAC. Redistribution of 
1,200 pounds from the front to the rear could have resulted in a CG of 35 percent MAC. 

5 In its investigation of a 1993 accident involving a United Airlines DC-8-54F in Detroit, the Safety Board 
found that “recovery of the airplane at rotation was possible if immediate nose-down trim was applied along with full 
forward elevator input.” However, the Safety Board concluded that “once the airplane left the ground and started to 
accelerate, recovery was improbable.” (See National Transportation Safety Board. 1983. United Airlines Flight 
2885, N8053U, Douglas DC-8-54F, Detroit, Michigan, January 11, 1983. Aircraft Accident Report NTSB/AAR- 
83/07. Washington, DC.) 
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Such a mistrim would cause a greater than expected nose-up pitching moment. This 
would be exacerbated by the lighter control column forces that result from an aft CG location. 
Consequently, the Safety Board concludes that the aft CG location and mistrimmed stabilizer 
presented the flightcrew with a pitch control problem; however, because the actual CG location 
could not be determined, the severity of the control problem could not be determined. 

The simulator flight tests could not replicate the accident flight precisely because of 
limitations inherent in the simulator; for example, the aerodynamic data upon which the 
simulator’s performance was based may not accurately model the actual airplane’s performance 
in ground effect (during rotation and initial climb) or when high-pitch rates are present near stall. 
Further, the simulator’s performance characteristics become invalid in the stall region. Timing of 
the control column movements in the simulated takeoff attempts was also a factor. Evaluation of 
the simulator data showed that small differences in the timing of inputs produced dramatically 
different results 5 to 10 seconds later. 

Unfortunately, it was also not possible to replicate precisely the flightcrew’s control 
inputs because, due to insufficient documentation, the control column position (CCP) positions 
recorded by the accident airplane’s FDR could not be converted into precise position values but 
rather represented relative motion. The Safety Board could not determine with certainty the 
correlation between the CCPs recorded by the FDR and actual positions of the control column on 
the airplane. Thus, the simulator tests did not permit the Safety Board to determine precisely the 
response of the accident airplane to the flightcrew’s control inputs. 

Flightcrew Actions 

Statements recorded on the CVR indicated that the flightcrew recognized a problem with 
airplane handling about the pitch axis immediately as the airplane rotated. At 12:35:51.5, 1.6 
seconds after the “rotate” call out and about 1 second after the first officer began to move the 
control column aft, the captain began his “easy easy easy easy” remark. Based on FDR data, it 
appears that the captain made his statement before the airplane’s pitch attitude had rotated 
significantly nose-up. The CCP moved aft a total of about 5°. About 2 seconds later (at 
12:35:53.5), still during rotation, the FDR showed forward movement of the control column. 
The magnitude of the forward movement was about 4° from its most aft position; however, about 
2 seconds after the start of the forward motion it was moved aft again. At 12:35:57 the control 
column was moved forward, and it reached its most forward position (presumed to be the full 
forward limit of the control column) at 12:36:01. 

The first officer’s continued aft column input for 2 seconds after the captain began his 
“easy easy easy easy” remark exacerbated the pitch-up that was developing from the mistrimmed 
stabilizer. However, the first officer’s 2-second response time in responding to the captain was 
understandable in light of the physiological, neurological, and cognitive contributors to reaction 
time. Further, is not clear that the flightcrew would have recognized the need for abrupt, 
aggressive, and sustained action at the initiation of the pitch-up. 
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Regarding the first officer’s subsequent aft control column input (at 12:35:54.5), the 
Safety Board notes that flightcrews are trained to avoid rapid and excessive control inputs and to 
gauge the results of control inputs before making additional corrections. In moving the control 
column forward and aft, the first officer might have been attempting to judge what nose-down 
control column inputs were required to correct the airplane’s developing pitch-up attitude. The 
Safety Board also notes that the application of immediate and forceful nose-down control inputs 
at rotation is counter-intuitive and contrary to the training and experience of line flightcrews. 

According to the CVR, the first trim-in-motion sound occurred a fraction of a second 
before the first aural stall warning (at 12:36:02), indicating that the trim inputs were not initiated 
until the accident airplane was already very close to a stall. Although aggressive nose-down trim 
inputs were made thereafter and until the trim reached its full nose-down position, about a 5- 
second delay occurred between the flightcrew’s first attempt to control the pitch-up with nose- 
down column inputs and the first inputs of nose-down trim. 

If the first officer had chosen to trim the airplane in the first, critical moments during and 
after rotation, he would have obtained a greater nose-down pitching moment and might have 
been able to correct most, or all, of the mistrim condition, preventing the airplane from stalling. 
The Safety Board considered the possibility that a more experienced pilot, particularly one who 
had previously encountered an aft-loaded, out-of-trim condition on takeoff, might have assessed 
the situation more rapidly and engaged the airplane’s powerful pitch trim more quickly to aid in 
the recovery attempt. For example, if the captain had been flying the takeoff, he might have 
more quickly recognized the need for and applied a trim correction. 

Although the Safety Board was unable to determine precisely how far aft the CG was 
located and thus the extent to which the airplane was mistrimmed, the Safety Board concludes 
that the mistrim of the airplane (based on the incorrectly loaded cargo) presented the flightcrew 
with a situation that, without prior training or experience, required exceptional skills and 
reactions that cannot be expected of a typical line pilot. Although the unanticipated nature of the 
rapid pitch-up was an important aspect of the situation, the Safety Board concludes that training 
for flightcrews in dealing with misloading, miscalculated CG, and mistrimmed stabilizers would 
imp rove the chances for recovery from such situations. However, there is no current FAA 
requirement for air carriers to provide flightcrews with training in identifying and responding to a 
rapid-pitch-up during rotation from a mistrimmed stabilizer. Therefore, the Safety Board believes 
that the FAA should require all 14 CFR Part 121 air carriers to provide flightcrews with 
instruction on mistrim cues that might be available during taxi and initial rotation, and require air 
carriers using full flight simulators in their training programs to provide flightcrews with Special 
Purpose Operational Training that includes an unanticipated pitch mistrim condition encountered 
on takeoff. 

Cargo Document Preparation, Communications, and Ramp Delivery Procedures 

In the hours before the accident flight, the exchange of airplanes required a series of 
significant cargo paperwork changes by Fine Air flight followers and Aeromar employees. Fine 
Air flight followers determined that the cargo weight would be 87,923 pounds and that the CG 
and trim would be 30 percent MAC and 2.4 units ANU if the airplane was loaded as directed. 
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Fine Air flight followers refined the weight and balance calculations for N30UA, the originally 
assigned airplane, to accommodate weight limitations for N27UA and then defined the pallet 
sequence to produce a more aft CG of 30 percent MAC (moving the pallet in position 13 to 
position 17 and leaving position 13 vacant). Fine Air flight followers stated that these changes 
were communicated to Aeromar by fax and by direct telephone conversations. However, the fax 
communications were the subject of conflicting statements by personnel from both companies. 
Further, there was no evidence that the revised paperwork was picked up by the Aeromar security 
guard responsible for the accident flight’s cargo. 

Although the Fine Air flight follower told Aeromar to reduce the weight of pallet “G” by 
1,000 pounds (reducing the total cargo weight to 87,923 pounds) because of the landing weight 
restrictions for N27UA, that weight was not removed by Aeromar. Therefore, the final load 
sheet provided to the flightcrew was in error by an additional 1,000 pounds. The mistake was 
missed by Aeromar and Fine Air. The Fine Air flight follower also improperly recorded the pallet 
weight in position 17 as 5,860 pounds on the final load sheet, rather than 5,960 pounds as 
recorded by Aeromar on the pallet loading form. 

The Safety Board’s investigation also revealed errors in the printed load sheet form. The 
form indicated that it was for a DC-8-61 airplane, but one part of the form that affected the CG 
calculation (the fuel distribution scale) was based on data for DC-8-62 and -63 airplanes. The 
printed Fine Air load sheet form also incorrectly listed the maximum weight allowable for pallet 
position 18 as 6,088 pounds, instead of the correct weight of 3,780 pounds, which resulted in 
pallet position 18 exceeding its weight limitation by 1,247 pounds on the accident flight. 
Calculations based on this form resulted in a computed CG that was farther aft than the actual 
CG. The proper loading form would have yielded a 26.5 percent MAC CG for 87,923 pounds 
rather than 30 percent MAC. The built-in CG errors could have accounted for reported flightcrew 
requests to Fine Air flight followers to provide more rearward CGs to improve the flying 
characteristics of their airplanes. However, moving the CG aft would not correct the mistrim but 
would lighten control forces somewhat 

Weight and balance errors were a persistent problem at Fine Air previously identified by 
two Department of Defense (DoD) inspections (in 1994 and 1996 respectively) and two FAA 
inspections (a preaccident national aviation safety inspection program [NASIP] inspection and a 
postaccident regional aviation safety inspection program [RASIP] inspection). Shortly after the 
1996 DoD inspection. Fine Air proposed redesigning its load sheet “as an interim measure until 
they automate weight and balance computations.” However, this redesign was not accomplished 
before the accident and would likely not have revealed the fuel loading and pallet weight errors 
in the load sheet. Further, the Safety Board found during its investigation that Fine Air’s load 
sheet, revised after the accident, also contained errors and discrepancies when compared to 
Douglas data, and that Fine Air’s stabilizer trim setting data sheet also contained errors. The 
Safety Board notes with disappointment that Fine Air revised the load sheet form incorrectly 
after errors were found after the accident, and that FAA principal inspectors assigned to Fine Air 
failed to detect this mistake. Based on an examination of Fine Air and Aeromar loading 
documents and statements from Fine Air and Aeromar employees, the Safety Board concludes 
that procedures used by Fine Air and Aeromar to prepare and distribute cargo weight pallet 
distribution forms and final weight and balance load sheets were inadequate to ensure that these 
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documents correctly reflected the true loading of the accident airplane. The Safety Board is 
concerned that similar problems may exist at other earners. Therefore, the Safety Board believes 
that the FA A should conduct an audit of all CFR Part 121 supplemental cargo operators to ensure 
that proper weight and balance documents are being used, that the forms are based on 
manufacturer’s data or other approved data applicable to the airplane being operated, and that 
FAA principal inspectors confirm that the data are entered correctly on the forms. 

There was conflicting information about whether the Aeromar and Fine Air employees 
involved in the loading operation were aware of the airplane change and of the changes in the 
loading instructions for the accident airplane. Aeromar’s vice president stated that a company 
security guard picks up loading paperwork at Fine Air “immediately prior to the loading of a 
plane” or when the security guard delivers the cargo to the Fine Air ramp. The Fine Air flight 
follower who calculated the original load for N30UA stated that the Aeromar security guard in 
charge of the cargo picked up the paperwork with the cargo before 0600 on the day of the 
accident. However, the flight follower who went on duty after 0600 stated that the security guard 
did not return to pick up the revised weight distribution form. Although Fine Air flight followers 
stated that they faxed updated weight distribution and loading information to Aeromar before the 
flight, Aeromar’s vice president stated that such a practice was “neither customary or usual.” 
Based on interviews with Aeromar employees, the security guard assigned to the flight’s cargo 
would have already been on duty at the Fine Air ramp when Fine Air flight followers said that 
they faxed the load changes to Aeromar. Testimony by Aeromar loaders indicated that cargo 
pallets were arranged on the ramp for loading according to the weight distribution form 
calculated for N30UA. Therefore, the Safety Board concludes that the security guard was not 
aware of the airplane change, and that he instructed Aeromar loaders to load the airplane in 
accordance with the weight distribution form he possessed for N30UA. 

Airplane Loading Operations 

Although there were conflicting statements about several aspects of the loading process, 
Aeromar cargo handlers’ descriptions of the initial loading were consistent with the planned 
weight and balance configuration for N30UA, with pallet positions 2 and 17 initially left vacant. 
However, Aeromar cargo handlers stated that pallets could not be secured with locks during the 
initial loading. A subsequent check by the Aeromar supervisor determined that pallet locks 
would not latch in the rear of the airplane because pallet edges were not positioned properly, 
preventing locks from engaging on each edge of adjacent pallets. 6 According to the statements of 
the loaders and supervisor, in an attempt to correct this, all pallets from position 5 aft were 
pushed back one position each, which resulted in pallet position 17 being filled and position 5 
being emptied. Pallet 4 was turned 90° and pushed back, which resulted in the pallet occupying 
all of position 5 and part of position 4. 7 According to loader statements, pallet 3 was secured by 


6 The Aeromar loading supervisor said the locks would not latch because cargo extended over the sides of 
the pallets. Because of conflicting testimony, it could not be determined who first identified the problem with the 
loading and who issued instructions to rearrange the load. 

7 These actions were initiated by the loading crew or its supervisors and did not adhere to any planned 
loading configuration for the cargo on this airplane, which was calculated in Fine Air operations by the Fine Air 
flight follower. 
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locks on the front and back sides, which would have left position 2, by the cargo door, empty, 
with position 1 (with locks up) by the forward (cockpit) bulkhead. Thus, based on loader 
statements about how the airplane was first loaded and subsequent changes to the cargo’s 
configuration, the Safety Board concludes that the accident airplane (N27UA) was initially 
loaded according to Fine Air’s load distribution for N30UA; further, the final load configuration 
did not match the planned load for either airplane. 

Loaders gave contradictory statements about the number of pallet engaged locks from 
positions 6 through 18 when the rearrangement and loading was completed. The Aeromar 
loading supervisor, who was. responsible for ensuring that pallet locks were in place, stated that 
he put up several locks near position 18, and that he relied on other loaders to put locks up 
forward of that position. However, the Safety Board found considerable evidence indicating that 
few of the pallet locks were engaged. For example, 57 of the 60 locks recovered from the 
wreckage (from a total of 85 installed) were found in the unlocked position, and postaccident 
testing found no evidence of cracking, shearing, or elongation associated with impact damage 
and failure. Although it was the Aeromar loading supervisor’s responsibility (according to his job 
description) to ensure that the locks were in place, he did not verify that they had been latched, 
relying instead on the thoroughness of loaders working in what was described as a hot, cramped, 

Q 

and stifling environment. 

Moreover, the Fine Air supervisor, who was the forklift driver (and, according to all 
parties involved, was not acting in a supervisory capacity) for the loading of the accident 
airplane, stated that when he was in charge of loading operations he always checked to make 
certain that the locks were up around pallet position 1. He said that he did so because these locks 
were readily visible to the flight engineer, who otherwise might insist on a reload if locks were 
down or missing. This implies that he believed it was less important to engage the locks that 
were not visible to the flight engineer, and suggests a casual attitude about the importance of 
aircraft weight and balance. 

Cargo loading requires the coordination of a team under the direction of a supervisor to 
accomplish a multistep process, including identifying the appropriate pallet, loading the pallet 
onto the airplane, positioning the pallet inside the airplane, and securing the pallet in position. 
These basic steps were not followed during the loading of the accident flight. When it became 
evident to the loading crew that the cargo would not secure properly, decisions were made about 
pallet positioning and load security that suggested a desire to complete the job quickly. Little or 
no attempt was made to determine whether these changes would adversely affect the airplane in 
flight. Therefore, the Safety Board concludes that the Aeromar cargo loading supervisor failed to 
ensure that the pallets were loaded according to an approved load plan (in this case neither load 
plan was followed) and failed to confirm that the cargo was properly restrained. 

Because there were vacant spaces in the cargo distribution and the cargo was not properly 
secured, the Safety Board considered whether shifting cargo at rotation could have contributed to 
the accident. Unsecured cargo pallets could shift during acceleration, and more significantly 


For example, loaders said the temperature inside of the airplane was “just like an oven,” However, it 
could not be determined to what extent, if any, these conditions contributed to the misloading of the airplane. 
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during rotation, if there were empty pallet positions between unsecured pallets. However, when 
Aeromar loaders pushed all of the cargo pallets from position 5 rearward one position and turned 
pallet 4 sideways into position 5, this created a line of contiguous pallets from position 5 to 
position 18, the aft-most cargo pallet position in the airplane. This suggests that the misloaded, 
aft-heavy condition existed at the time of rotation and was not caused by cargo shifting as the 
airplane’s deck angle increased. However, based on loader statements that cargo extended over 
the sides of some pallets (which prevented the locks from being engaged), some shifting of cargo 
and additional compression might have occurred as the airplane’s deck angle increased. The 
Safety Board concludes that a significant shift of cargo rearward at or before rotation did not 
occur and was not the cause of the initial extreme pitch-up at rotation; although, cargo 
compression or shifting might have exacerbated the pitch-up moment as the pitch increased. 

Following the accident, the FAA’s RASIP inspection team found numerous problems 
related to Fine Air’s loading operations, including improperly secured and broken pallets, frayed 
and broken netting, and deficiencies in the areas of weight and balance control, cargo weighing, 
and security. These areas were also addressed in a consent agreement Fine Air signed with the 
FAA in September 1997, in which the operator agreed to revise its cargo handling system and 
procedures, including its “maintenance program for cargo pallets and cargo restraint devices, 
cargo pallet loading procedures, cargo weighing procedures...aircraft loading procedures [and] 
aircraft weight and balance procedures.” 

As part of its revised procedures. Fine Air developed a loading supervisor certification 
form that loading supervisors must sign to indicate that the load was placed on the airplane 
according to plan and restrained properly. In addition, the revised Flight Operations Manual 
(FOM) breaks down the loading process into specific procedures and steps to be followed by the 
loading supervisor when loading the airplane, 9 which helps to standardize the loading process. 

However, the load certification form only contains an overall statement attesting to the 
fact that loading was performed in accordance with Fine Air’s loading requirements. Cargo 
loading supervisors and cargo handlers work under difficult conditions that can include physical 
strain, time pressure, extreme temperatures, and nighttime hours, all of which can affect job 
performance. Thus, the Safety Board concludes that the difficult work environment of cargo 
loaders has the potential to cause loading errors if the loading process is not adequately 
structured to compensate for the detrimental environmental effects on human performance. 
However, these conditions can be mitigated by developing independent controls to ensure that 
critical steps in the loading process are completed properly. Therefore, the Safety Board believes 
that the FAA should require carriers operating under 14 CFR Part 121 to develop and use loading 
checklists to positively verify that all loading steps have been accomplished for each loaded 
position on the airplane and that the condition, weight, and sequencing of each pallet is correct. 


9 

In addition to the loading supervisor certification form, Fine Air made significant revisions to its FOM, 
AOM, and other documents outlining new load planning procedures, loader and supervisor responsibilities, and 
flightcrew responsibilities after resuming operations in October 1997 under the consent agreement. The airline stated 
that it now has provisions in place to ensure that pallets are built properly, that weights are verified (e.g., pallets are 
now weighed by Fine Air before being loaded), and that loading operations are thoroughly supervised. 
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Operational Control 

Fine Air’s wet lease agreement with Aeromar called for Aeromar to provide “fuel, 
loading and unloading at all stops,” but stipulated that Fine Air retained operational control of all 
flights, and that all servicing was to be done under the supervision of Fine Air employees. Fine 
Air’s operational control responsibilities were also defined in the company’s FOM and spelled 
out in an addendum to Fine Air’s lease agreement with Aeromar. Although 14 CFR Part 121.537 
outlines supplemental air carrier operational control responsibilities, the principal operations 
inspector (POI) assigned to Fine Air stated that operational control for loading was not 
specifically addressed in the regulations. Further, the Safety Board could identify no such 
requirement in these regulations. However, the FAA stated in an October 1997 letter to Fine Air 
that under provisions of Part 121, “no aspect of operational control can be negotiated 
away...[including] loading of cargo as it relates to weight and balance requirements, cargo 
restraint requirements and hazardous materials requirements.” 

Although the terms of the wet lease agreement (later determined by the FAA to be a 
“transportation” or “charter” agreement) stated that Fine Air retained operational control. Fine 
Air managers stated that before the accident the company did not supervise loading operations 
carried out by Aeromar. In addition. Fine Air did not weigh palletized cargo delivered by 
Aeromar or have other procedures in place to verify cargo weights and the accuracy of the load 
form provided to the crew by Fine Air flight following. The Safety Board concludes that Fine Air 
failed to exercise adequate operational control of loading operations conducted by Aeromar on 
the accident flight as required by Part 121, the operational control terms of its lease agreement 
with Aeromar, and its own operating policy. Further, the Safety Board concludes that Fine Air’s 
failure to exercise adequate operational control was causal to the accident by creating an 
operational environment in which cargo was loaded into Fine Air airplanes without verification 
of pallet weights and proper load distribution and by fostering a management philosophy that 
allowed airplanes to be dispatched without verification and control procedures in place to ensure 
that load-related, flight safety-critical tasks had been accomplished. 

Loader Experience and Training 

Four of the Aeromar cargo handlers had previous experience in air cargo operations in 
Miami. However, one cargo handler and the Aeromar loading supervisor had no experience in air 
cargo operations before employment with Aeromar. The Aeromar loading supervisor was hired 
about 3'/2 months before the accident and had been promoted to supervisor about 2 weeks before 
the accident on the basis of his performance. All cargo loading personnel interviewed by Safety 
Board investigators accurately described how to engage and disengage cargo locks and 
demonstrated a general knowledge of proper cargo loading procedures. 

Air carriers are currently not required to provide initial classroom training or recurrent 
training for personnel involved in cargo handling. Training for loading personnel at Aeromar 
and Fine Air was described as on-the-job training. Aeromar cargo handlers stated that they did 
not receive any classroom training and that their supervisor had provided verbal instructions and 
information about the job of loading an airplane when they First were assigned to the cargo ramp. 
Aeromar cargo handlers who had previously worked at Fine Air indicated that while at Fine Air 
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they received no classroom training. The Fine Air loading supervisor also stated that he had 
received no classroom training for cargo loading. Although it appears that on-the-job training 
was an effective method of instruction for the basic technical job requirements, the misloading of 
the accident airplane indicates that loaders did not recognize the importance of loading an 
airplane consistent with the calculated weight and balance plan, or the importance of properly 
restraining the cargo. Therefore, the Safety Board concludes the loaders who loaded the accident 
airplane were not aware of the potentially catastrophic consequences of misloading the airplane 
and the failing to properly secure cargo, and that this contributed to the accident. 

It is the Safety Board’s understanding that cargo handler positions are typically entry- 
level positions characterized by relatively high rates of turnover. The Safety Board is concerned 
that because of a high turnover rate it can be difficult to control the quality of instruction 
delivered through on-the-job training. Because it is critical to the safety of flight to ensure that 
cargo has been loaded according to plan and properly restrained, all individuals associated with 
the loading process must be provided with consistent and comprehensive training in airplane 
loading. 

After the accident, the FA A issued air transportation bulletin Handbook Bulletin for 
Airworthiness and Air Transportation (HBAT) 97-12 to FAA Order 8400.10 “Air Transportation 
Operations Inspector’s Handbook.” 10 In this bulletin the FAA states the following: 

Currently, part 121, section 121.400 prescribes the requirements applicable to each 
certificate holder for establishing and maintaining a training program for 
crewmembers, aircraft dispatchers, and other operations personnel. While the term 
“other operations personnel” is not currently defined in this subpart, it is evident that 
employees of a certificate holder who have the duty to supervise the loading of an 
aircraft or who qualify and authorize other persons to perform this function, must be 
trained on the certificate holder’s procedures. 

The bulletin encouraged principal inspectors to review any training program operators 
had for their cargo loading supervisors. 

In the consent agreement issued after the accident, the FAA required Fine Air to “review 
and revise as necessary a training program for cargo handlers and other personnel responsible for 
cargo handling and aircraft loading.” In response, Fine Air created a training program for cargo 
loader supervisors and cargo handlers 11 that included approximately 7 hours of training including 
curriculum areas covering the following: 

• basic aerodynamics 

• weight and balance for ground handlers 


10 The bulletin was issued on September 5, 1997, as a Joint Flight Standards Handbook Bulletin; therefore, 
it was also added to FAA Order 8300.10, “Airworthiness Inspector’s Handbook” as HBAW 97-12. 

11 Fine Air’s training manual states that “This category of training is for an employee whose job description 
includes the identification of, positioning, direct and indirect handling of cargo to be loaded on FINE AIR aircraft to 
ensure the proper loading and handling of cargo aboard company aircraft.” In addition to initial training there are 
provisions for recurrent training in this program. 
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• safe handling of aircraft cargo 

• pallet building, loading, and unloading. 

The Safety Board considers the steps taken by Fine Air to provide formal training to its 
cargo handling personnel to be a significant improvement in its training program because the 
curriculum is standardized and training modules go beyond the technical requirements of the job. 
However, the Safety Board recognizes that the consent agreement was directed only to Fine Air 
and is concerned that the training programs of other operators may suffer from similar 
deficiencies. Further, HBAT 97-12 only encouraged inspectors to examine operators’ training 
for supervisory cargo loading personnel, and inspectors do not have the appropriate guidance 
material to evaluate training programs in cargo handling operations. Thus, the Safety Board 
concludes that formal training is necessary to ensure that cargo handling personnel receive 
standardized instruction on safety-critical aspects of the loading process. Therefore, the Safety 
Board believes that the FAA should require training for cargo handling personnel and develop 
advisory material for carriers operating under 14 CFR Part 121 and POIs that addresses 
curriculum content that includes but is not limited to, weight and balance, cargo handling, cargo 
restraint, and hazards of misloading and require all operators to provide initial and recurrent 
training for cargo handling personnel consistent with this guidance. 

Flightcrew Load Verification Responsibilities 

According to the Fine Air Aircraft Operation Manual (AOM) used at the time of the 
accident, the flight engineer was required to verify that at least three cargo pallet locks were 
locked at each position loaded with a pallet during his preflight check in Miami. However, Fine 
Air representatives told Safety Board investigators that it would have been “unlikely” for a flight 
engineer to make this check of the entire airplane during routine operations in Miami. 14 Other 
company personnel indicated that in Miami airplanes were typically loaded before flightcrews 
arrived and some loads did not provide sufficient clearance for the flight engineer to verify the 
status of the locks in positions aft of the cargo door. 15 The Safety Board recognizes that Fine Air 
changed the flight engineer’s preflight checklist after the accident as part of a review and revision 
of its loading procedures and that new controls are now in place to ensure that the locks are 


FAA Order 8400.10 does not provide guidance on evaluating training programs for cargo loading 
operations. In contrast, FAA Order 8400.10 and advisory circular (AC) 120-60 provide guidance material for FAA 
inspectors reviewing the initial and recurrent training programs that air carriers establish as part of their ground 
deicing and anti-icing programs under 14 CFR 121.629. 

13 

At least one industry trade union, the International Association of Machinists and Aerospace Workers, 
stated that it offers training to ramp workers and other aviation personnel on the impact on flight safety of routine 
duties such as cargo loading, hazardous materials handling, and deicing operations. 

14 According to Fine Air’s FOM, it is the joint responsibility of the first officer and the flight engineer to 
ensure proper airplane loading at outstations. 

15 Pallets are typically configured so that there is access to the area around the cargo door, to verify that 
door has been secured. Therefore, it is likely that the flight engineer was able to verify locks were up on positions 1 
and 3 in the accident airplane. Loaders told Safety Board investigators that if these locks were not locked and visible 
to the flightcrew they risked being asked to reload. The current Flight Engineer’s Preflight expanded checklist (page 
6-12-19, issued 9/26/97, revision 35) only requires a check that all pallet locks installed in the airplane be operable. 
It no longer requires the engineer to ensure that a minimum of three pallet locks per position be used and locked. 
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engaged. However, at the time of the accident the flight engineer faced inconsistent guidance 
and expectations about this task. Thus, the Safety Board concludes that although the flight 
engineer was required to ensure that all cargo pallet locks were locked, company operating 
procedures and practices in MIA hindered him from accomplishing this task. Further, the Safety 
Board is concerned that such differences between flightcrew requirements for loading oversight 
and actual operational procedures may exist at other air carriers. Therefore, the Safety Board 
believes that the FAA should review the cargo loading procedures of carriers operating under 14 
CFR Part 121 to ensure that flightcrew requirements for loading oversight are consistent with the 
loading procedures in use. 

; 

Although they possessed the airplane’s load sheet (based on numbers provided by Fine 
Air flight followers) and the flight engineer was required to conduct a visual inspection, the 
accident flightcrew had no practical way to verify the airplane’s weight and balance and gross 
weight before takeoff. However, the Safety Board notes that an electronic system has been in 
widespread use for years in both cargo and passenger operations that provides flightcrews with a 
digital readout in the cockpit of weight and balance and gross weight values. The STAN (Sum 
Total Aft and Nose) system uses pressure transducers to convert main gear and nose gear shock 
strut air pressure to an electronic signal. The cockpit readout, on the flight engineer’s instrument 
panel, provides the flightcrew with an independent, direct measure of the airplane’s gross weight 
and CG. Cockpit instrumentation showing these values would have added a critical last-minute 
safeguard for this flightcrew. Thus, the Safety Board concludes that if the flightcrew had had an 
independent method for verifying the accident airplane’s actual weight and balance and gross 
weight in the cockpit, it might have alerted them to the loading anomalies, and might have 
prevented the accident. Therefore, the Safety Board believes that the FAA should evaluate the 
benefit of the STAN and similar systems and require, if warranted, the installation of a system 
that displays airplane weight and balance and gross weight in the cockpit of transport-category 
cargo airplanes. 

FAA Surveillance and Oversight 

The FAA’s RASIP inspection of Fine Air following the accident found anomalies that the 
inspection team’s report characterized as “an indication of a systemic problem at Fine Airlines.” 
Echoing findings in previous preaccident FAA and DoD inspections, the RASIP report stated 
that inspectors had found problems in the areas of weight and balance control, cargo weighing, 
the accuracy of pallet weights, the condition of pallets and netting, and the condition of airplane 
cargo compartments and equipment. All of these findings, the report concluded, had “an impact 
on the safety of flight.” 

FAA inspectors assigned to Fine Air and Miami Flight Standards District Office (FSDO) 
managers stated that before the Fine Air accident, there was “no guidance,” or “minimal 
guidance,” in FAA written directives for the surveillance of cargo operations, and that there were 
no guidelines on how to evaluate the condition of pallets, netting, and other cargo equipment. 
The principal maintenance inspector (PMI) assigned to Fine Air described his attitude to cargo 
inspection before the accident as “to us, cargo is cargo.” However, the team leader of the 
postaccident RASIP inspection at Fine Air, who is a PMI assigned to the United Parcel Service 
certificate, stated that specific guidance should not have been needed to discover the problems 
the RASIP inspection team found relating to the condition of pallets, nets, and cargo deck 
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flooring, noting that these problems were “evident.” Moreover, during an en route inspection to 
Santo Domingo conducted a week before the accident, the Fine Air PMI was able to identify 
numerous loading problems, including damaged pallet netting, improper cargo loading, and a 
scale that was not in a location to weigh pallets. Although the PMI wrote a letter to Fine Air after 
the accident (on August 11, 1997) that asked Fine Air to amend its work cards for “C” checks in 
the areas identified as deficient during the en route inspection, no enforcement case was opened 
based on these findings, and the PMI did not take any other direct action to correct the immediate 
problem. 

The manager of the FAA’s Miami FSDO stated that he believed that the FAA 
surveillance of Fine Air’s operations was “adequate” before the accident, but acknowledged that 
inspectors were “concentrating their emphasis on other areas,” not on cargo loading. The FAA 
regional director, based in Atlanta, whose jurisdiction included the Miami FSDO, stated that “it’s 
hard to define quality of surveillance,” but acknowledged that the problems found in the RASEP 
should have been found earlier by the principal inspectors assigned to Fine Air. 

Although the regional director noted that local inspectors can become bogged down in 
“certificate maintenance” (manual revisions, training program oversight, and other paperwork 
duties) at the expense of surveillance, even when they are aware of the findings of special 
inspections conducted by other teams, the director conceded that operations involving older 
airplanes, less experienced crews, and a “smaller [cost/profit] margin...are a concern.” 
Nevertheless, cargo loading and weight and balance problems were repeatedly identified at Fine 
Air before and after the accident, and inspectors assigned to Fine Air had discovered and 
documented at least some of these problems before the accident. Therefore, the Safety Board 
concludes that the FAA inspectors assigned to Fine Air failed to ensure that known deficiencies 
in Fine Air’s cargo operations were corrected. Thus, these problems went beyond a lack of 
broader FAA inspector guidance on inspecting cargo operations, and the FSDO manager 
conceded that senior FAA management had expressed “concern that we’re not proactive.” 

Although the problems with the Miami FSDO’s surveillance program at Fine Air 
pertained mostly to a failure to act on findings, the Safety Board is also concerned that the 
surveillance of cargo loading operations is not specifically required in the annual work programs 
established for FAA flight standards inspectors. The Safety Board concludes that die entire 
sequence of cargo loading operations, from preparation of the pallets/containers through the 
information provided to flightcrews, has a direct effect on flight safety and should not be 
neglected by the FAA surveillance program, particularly for the cargo air carriers operating under 
14 CFR Part 121. Therefore, the Safety Board believes that the FAA should require all principal 
inspectors assigned to 14 CFR Part 121 cargo air carriers to observe, as part of their annual work 
program requirements, the complete loading operation including cargo weighing, weight and 
balance compliance, flight following, and dispatch of an airplane. 

During its investigation of this accident, the Safety Board found numerous preaccident 
indicators of problems not only at Fine Air, but at other cargo Part 121 operators under the 
jurisdiction of the Miami FSDO. In the case of Fine Air, these included the findings of previous 
NASIP, RASIP, and DoD inspections at Fine Air. In another situation similar to Fine Air, 
Miami-based cargo operator Millon Air voluntarily ceased operations on October 24, 1996, 
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following an FAA inspection conducted after a Millon Air Boeing 707 freighter crashed in 
Manta, Ecuador, two days earlier on October 22, 1996. (In its investigation of several previous 
accident and incidents involving Millon Air, the Safety Board had found a series of FDR-related 
maintenance deficiencies). In 1995, the FAA suspended the operating certificate of another 
Miami-based Part 121 cargo and passenger carrier, Arrow Air, after an inspection found evidence 
of serious safety violations. Thus, the Safety Board concludes that the Miami FSDO lacked clear 
management policies to ensure that sufficient and appropriate surveillance was conducted and 
that surveillance results were acted upon; further, the FSDO was not aggressive in its inspection 
and management of the Fine Air certificate and this contributed to the accident. 

Such cases were not limited to the Miami FSDO. In the case of the May 11, 1996, 
accident in the Florida Everglades involving a ValuJet DC-9-32, FAA postaccident inspections 
found numerous maintenance and operational deficiencies that resulted in the air earner ceasing 
operations when it entered into a consent agreement with the FAA in June 1996. Deficiencies in 
ValuJet’s operations had been thoroughly documented in an FAA report prepared before the 
accident and in RASIP and NASIP inspections conducted before the accident. The February 14, 
1996, report noted “some weakness in the FAA surveillance” of the airline and inattention to 
“critical surveillance activities.” The report, which recommended that consideration be given to 
the “immediate recertification” of the airline, was not provided to the Atlanta FSDO or to 
ValuJet until after the accident. These maintenance and operations-related problems, which were 
identified by FAA regional management as requiring greater scrutiny and concern, should have 
been sufficient to alert the FAA’s senior managers to the need for more aggressive surveillance 
and before the Fine Air accident. Since the accident, FAA officials have acknowledged that 
under current oversight programs what they described as system failures like Fine Air are 
difficult to detect, and that the existing system of surveillance was inadequate. Moreover, a 
recent GAO report on the effectiveness of FAA inspector surveillance concluded that many FAA 
inspections “are not thorough or structured enough to detect many violations,” and that 
inspectors often do not initiate enforcement actions because “doing so entails too much 
paperwork.” Based on these repeated problem indicators and the FAA’s acknowledgement of the 
shortcomings of its current oversight system, the Safety Board concludes that the deficiencies 
found in the Miami FSDO’s oversight of Fine Air and other carriers in its jurisdiction are 
indicative of a broader failure of the FAA to adequately monitor air carriers, especially 
supplemental cargo carriers, in which operational problems had been identified. 

Based on its investigation of the ValuJet Everglades and the Fine Air accidents, the 
Safety Board is also concerned about the effectiveness of the NASIP and RASIP inspection 
processes. In the case of each airline, preaccident inspections identified operational and 
airworthiness deficiencies. Although the findings of these inspections resulted in short-term 
corrective actions for the specific items that were found to be deficient, the inspections failed to 
identify and address systemic problems that were found in postaccident inspections of both 
carriers and that resulted in their temporary shutdown. The FAA has developed considerable 
information on cargo-related problems from the results of two special emphasis ramp checks 
conducted after the Fine Air accident. However, the FAA Administrator noted in a March 3, 
1998, memorandum that “much work remains to correct systemic problems with FAA’s aviation 
safety inspection program.” Further, FAA representatives told Safety Board investigators that 
“data collection, analysis and corrective actions are not well focused.” The results of this 
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investigation indicate that these deficiencies apply to both local FSDO surveillance and to 
NASIP and RASIP inspections. Thus, the Safety Board concludes that NASIP and RASIP 
inspections are not adequately identifying and addressing systemic safety problems that exist in 
air carrier operations at the time the inspections are conducted. Therefore, the Safety Board 
believes that the FAA should review its NASEP and RASIP inspection procedures to determine 
why inspections preceding these accidents failed to identify systemic safety problems at ValuJet 
and Fine Air and, based on the findings of this review, modify these inspection procedures to 
ensure that such systemic indicators are identified and corrected before they result in an accident. 

The Safety Board notes current FAA initiatives to redesign and improve FAA oversight 
of air carriers, including the development and implementation of the Air Transportation 
Oversight System (ATOS) program designed to target resources and inspections to identify 
systemic safety problems. The Safety Board is also encouraged by the FAA’s recent enforcement 
actions against cargo carriers based on standards developed after the Fine Air accident. Also 
encouraging are FAA proposals to better focus geographic inspector surveillance, planned 
changes in the new entrant carrier certification process and improved methods for the collection, 
analysis, and inspector access to FAA surveillance and safety trend data (the more effective use 
and dissemination of safety performance analysis system and program tracking and reporting 
system data): Although these and other proposed changes are in response to Safety 
Recommendation A-96-163, issued following the 1995 Tower Air accident, are steps forward, 
the Safety Board is concerned that some operators that may benefit most from additional scrutiny 
have not been included in the initial implementation phases of the ATOS program. The program 
is being launched at 10 of the nation’s largest carriers, for which FAA surveillance is already 
considerable, and operational incidents and accidents are relatively rare. 

Although it is understandable why the FAA wants to “refine the new model” before 
expanding to other sectors of the industry, the Safety Board is nevertheless concerned about the 
potential for delays inherent in the implementation of such a comprehensive redesign of the FAA 
surveillance system. Initial implementation at the 10 designated carriers is not scheduled until 
October 1998. Although the proposed changes to the FAA oversight system address the intent of 
Safety Recommendation A-95-163, the Safety Board will continue to monitor the FAA’s 
progress in implementing these changes. Pending further action, the Safety Board reiterates its 
February 23, 1998, classification of Safety Recommendation A-95-163 as “Open—Acceptable 
Response.” 

However, the Safety Board remains concerned about the FAA’s ability to successfully 
enhance its surveillance capability at current budget and personnel resource levels, especially at a 
time when the aviation industry is growing rapidly and increasing demands are being placed on 
the agency’s certificate management system. Indeed, principal inspectors assigned to Fine Air 
stated that they needed assistance in accomplishing their tasks and that the number of en route 
inspections they conducted were reduced because of scheduling, workload, and budget 
constraints. Following a February 16, 1995, accident involving an Air Transport International 
DC-8-63, the Safety Board issued Safety Recommendation A-95-111, which asked the FAA to 
determine whether its budget and personnel resources were sufficient to maintain its surveillance 
programs adequately. Although the Safety Board in 1996 classified A-95-111 “Closed— 
Acceptable Action” following an FAA response stating that resources were “properly allocated to 




17 


maintain oversight at an adequate level,” the Safety Board concludes that, based on its 
investigation of the Fine Air accident, current FAA personnel and budget resources may not be 
sufficient to ensure that the quality of air carrier surveillance will improve. Therefore, the Safety 
Board believes that the FAA should evaluate the surveillance programs to ensure that budget and 
personnel resources are sufficient and used effectively to maintain adequate oversight of the 
operation and maintenance of both passenger and cargo carriers, irrespective of size. 

Loss of FDR Data 

The failure of the accident airplane’s FDR to record 6 of the 11 required parameters of 
data hampered the Safety Board’s investigation into the pitch-up and stall events that resulted in 
the airplane’s departure from controlled flight. The FDR did not record information about engine 
data, airspeed, pitch and roll attitudes, vertical acceleration, and microphone keying, all of which 
would have been immensely useful in understanding the accident scenario. 

The Safety Board has long been concerned about problems related to the absence of FDR 
data critical to accident investigations and has made a series of recommendations beginning in 
the early 1970s to improve FDR accuracy, expand the number of parameters, and require 
verification of parameter recordings. Continued concerns about the airworthiness of FDRs 
resulted in the Safety Board’s issuing two recommendations to the FAA in 1991 (Safety 
Recommendations A-91-23 and -24) aimed at developing a permanent policy for FDR 
maintenance and recordkeeping. Further, in 1997, following a series of accidents that involved 
problems with recordings on retrofitted FDRs, the Safety Board issued two additional safety 
recommendations (Safety Recommendations A-97-29 and -30) asking the FAA to require 
readouts of retrofitted 11-parameter FDRs to ensure that all required parameters were being 
recorded properly and to complete, by January 1998, an FAA-promised AC addressing the 
installation and maintenance of FDRs. 

The problems with the Fine Air FDR in this accident once again underscore the need for 
prompt action in determining the functionality and airworthiness of retrofitted 11-parameter 
FDRs, the importance of FDR certification and maintenance requirements, and the importance of 
accurate FDR documentation. In the case of Fine Air, in addition to the six parameters that were 
missing, the heading data were recorded on three parameters and in reverse. The Safety Board 
notes with concern that these deficiencies were found less than 4 months after a maintenance 
examination of the FDR that required the unit to be “downloaded into a computer capable of 
determining that all parameters are being recorded” and 3 months after it was overhauled and 
bench checked. 

The Safety Board also notes with disappointment that the AC promised by the FAA to be 
issued by January 1998 has not yet been completed, even though the Safety Board provided a 
draft version of the AC upon request by FAA staff. The Safety Board has stated several times 
that inclusion of guidance relating to FDR maintenance documentation (which was addressed in 
FAA Notice N8110.65) into this AC would satisfy the intent of Safety Recommendations A-91- 
23 and -24. An AC addressing FDR maintenance and FDR certification would also satisfy the 
intent of Safety Recommendation A-97-30. However, the Safety Board is concerned that the AC, 
already delayed more than 7 years, still may not be produced in a timely manner. This AC is also 
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essential to reduce retrofit problems that could occur on a much larger scale than those 
encountered during the less-sophisticated 11-parameter retrofit program. Accordingly, the Safety 
Board classifies Safety Recommendations A-91-23, A-91-24, and A-97-30 “Open— 
Unacceptable Response” pending the FAA’s completion of the AC. 

The Safety Board is also disappointed with the adequacy of the FAA’s response to 
determine the airworthiness of retrofitted, 11-parameter FDRs, as requested in Safety 
Recommendation A-97-29 in May 1997. Although the FAA stated in a July 1997 response letter 
that it agreed with the intent of the recommendation and planned to require air carriers to perform 
readouts of all retrofitted 11-parameter FDRs within 180 days of the issuance of a new FDR 
flight standards bulletin (which became effective on December 15, 1997), the timetable intended 
for these readouts was not specified. For example, HBAW-97-13B, issued in response to Safety 
Recommendation A-97-29, made no mention of the 180-day timetable for readouts and only 
proposed scheduling FDR maintenance at “C” check intervals as part of the new FDR 
maintenance program guidelines it outlined. 16 Under the “C” check interval inspection plan 
described in the bulletin, Fine Air flight 101’s FDR might not have been due for inspection until 
January 2001. This timeframe for completing a full readout of 11-parameter FDRs is not 
acceptable and does not address the intent of Safety Recommendation A-97-29. 

Recent events suggest that the necessity for these readouts remains. Since the Fine Air 
accident, the Safety Board encountered yet another malfunction involving an 11-parameter 
retrofit, installed on an American Airlines Boeing 727 that landed short of runway 14R at O’Hare 
International Airport, in Chicago, Illinois, on February 9, 1998. Although the investigation is riot 
complete, an initial readout of the accident airplane’s FDR determined that data recorded on the 
elevator/pitch and longitudinal acceleration parameters were unuseable, resulting in the loss of 
information potentially critical to determining the cause of the accident. The Safety Board notes 
that this FDR malfunction occurred on an airplane maintained by a large international air carrier 
with extensive maintenance resources and substantial FAA oversight. FDR system 
documentation provided by the airline indicates that the elevator position sensor might have been 
installed incorrectly, and that this condition was not discovered during a functional test 
conducted at a “C” check in November 1997. Examination of the elevator parameter data 
suggested that the person who performed the functional test either wrote the results in the wrong 
place or that the elevator values were reversed, with the value for “full column forward” in the 
correct value range for “full column aft” and vice-versa. Although the Safety Board has not yet 
drawn a conclusion regarding the ground test, the Safety Board is concerned that these 
malfunctions might have resulted in improper parameter installation and/or maintenance. 

The Fine Air accident also highlights the importance of proper documentation of FDR 
maintenance actions and readout results. Although Fine Air’s maintenance manual required that 
the accident airplane’s FDR data be downloaded into a computer to determine that the 
parameters were being recorded properly, the maintenance job card that tracked the work 


16 At Fine Air, a C check interval occurs every 3,300 hours, or 36 months. 

17 Examination of the data recorded on the longitudinal acceleration parameter indicated that the data were 
more representative of data for lateral acceleration, suggesting that the accelerometer might have been incorrectly 
installed on the airplane, resulting in lateral, rather than longitudinal, data being recorded. 
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performed did not require this readout data to be printed or retained. Only a mechanic’s signature 
was required to certify that the readout had been accomplished. Consequently, there was no way 
for another person to verify that the readout was correct. The Safety Board concludes that 
permanent documentation of FDR computer readouts is needed to later verify that such readouts 
have been properly accomplished. 

Based on the continued discovery of malfunctioning 11-parameter FDRs and because the 
findings of this accident investigation indicate that it is advisable to require air carriers to 
maintain the records of FDR readouts, the Safety Board classifies Safety Recommendation A-97- 
29 “Closed—Unacceptable Action/Superseded” and believes that the FAA should require an 
immediate readout of all 11-parameter retrofitted FDRs to ensure that all mandatory parameters 
are being recorded properly; that the FDR system documentation is in compliance with the range, 
accuracy, resolution, and recording interval specified in 14 CFR Part 121, Appendix B; and 
require that the readout be retained with each airplane’s records. 18 

The number of recent confirmed FDR malfunctions also suggests that the problem may 
go well beyond the scope of 11-parameter retrofits. Indeed, the number of problems encountered 
with 11-parameter FDRs suggests either inadequate installations or maintenance of FDR systems. 
The Safety Board is concerned that the problems encountered with 11-parameter FDR retrofits 
will not only continue, but worsen, without further corrective action as additional mandated 
parameters are added according to phase-in requirements under 14 CFR Part 121.343 and 
Appendix B. 19 Thus, the Safety Board concludes that current and proposed inspection intervals 
for FDRs (at each “C” check) are not adequate because of fleet utilization variables at many 
carriers. Therefore, the Safety Board believes that the FAA should require maintenance checks 
for all FDRs of aircraft operated under 14 CFR Parts 121,129,125, and 135 every 12 months or 
after any maintenance affecting the performance of the FDR system, until the effectiveness of the 
proposed AC and new FAA inspector guidance on continuing FDR airworthiness (maintenance 
and inspections) is proven; further, these checks should require air carriers to attach to the 
maintenance job card records a computer printout, or equivalent document, showing recorded 
data, verifying that the parameters were functioning properly during the FDR maintenance check 
and require that this document be part of the permanent reporting and recordkeeping maintenance 
system. 

Although an FDR’s primary function is to provide detailed flight information following 
an accident or' incident, this detailed flight information is useful even in the absence of an 
accident or incident. The Safety Board notes that the FDR phase-in requirement and the quick 
access capabilities of modem solid-state FDRs offer operators the opportunity to develop and 
implement a flight operations quality assurance (FOQA) program. Analysis of downloaded 


18 Appendix B outlines FDR specifications, including parameters, range, accuracy, sampling interval, and 
resolution. 

19 Under Part 121.343, all airplanes manufactured on or before October 11, 1991, with 30 or more seats 
will be required to have FDRs equipped with 22 channels (or 18 for those units that do not have flight data 
acquisition unitss no later than August 18, 2001). Airplanes manufactured after October 11, 1991, up to August 18, 
2000, will be required to have FDRs with 34 channels. Transport airplanes manufactured between 2000 and 2002 
will be required to have 57-parameter FDRs, and airplanes manufactured after August 18, 2002, will be required to 
have 88-parameter FDRs. 
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FOQA data enables operators to enhance crew and aircraft performance, to develop tailored 
training and safety programs, and to increase operating efficiency. FOQA programs can also be 
used to refine ATC procedures and airport configurations and to improve aircraft designs. 
Although FOQA programs based on the minimum 18 parameters called for in the FDR phase-in 
requirements would have some limitations, the potential safety and operational benefits of even a 
limited program are significant. 

Because frequent FDR data downloads and data analysis are components of a viable 
FOQA program, the requirement for periodic readouts to validate the quality of the mandatory 
FDR parameters would likely be met if the operator corrected recording problems discovered in 
the readout. The need to download and analyze FDR would also require operators to maintain 
sufficient FDR system documentation to meet the Safety Board’s needs in the event of an 
accident or incident. 

In a May 1997 letter to the FAA, the Safety Board listed a series of accidents and 
incidents from 1991 through 1997 that involved problems extracting data from retrofitted FDRs. 
Because many of the problems encountered with retrofitted FDRs have resulted from improper 
installation and poor system documentation, the Safety Board is concerned that deficiencies may 
exist in the supplemental type certificate (STC) process; and that retrofit errors and problems are 
not being identified and corrected by FAA inspectors. 20 An FDR’s primary function is to provide 
detailed flight information following an accident or incident; it does not otherwise affect the 
airworthiness of an aircraft. As a result, air carrier maintenance technicians may not view the 
FDR system as critical to the operation of the airplane, and FAA avionics inspectors may have 
little or no exposure to the complex data collection and recording features of FDR systems. Thus, 
the Safety Board concludes that FAA principal avionics inspectors (PAIs) may lack the 
experience and training to provide adequate oversight of FDR installations and continued FDR 
airworthiness requirements. Therefore, the Safety Board believes that the FAA should provide 
FAA PAIs with training that addresses the unique and complex characteristics of FDR systems. 
Further, the Safety Board believes that the FAA should create a national certification team of 
FDR system specialists to approve all STC changes to FDR systems. 

Deficiencies in Fine Air’s CAS Maintenance Program 

A Safety Board review of the accident airplane’s maintenance logs for the 90-day period 
before the accident indicated a significant number of recurring problems involving the engines, 
belly cargo doors, and thrust reversers. Although none of these problems were factors in the 
accident, the Safety Board is concerned because the continuing analysis and surveillance (CAS) 
program was designed to alert operators to repeat deficiencies and to facilitate prompt corrective 
maintenance action in problem areas. Fine Air’s director of quality control stated that these 
repetitive repairs often involved “different parts” of “an old system.” However, the number and 
similarity of the maintenance discrepancies on the accident airplane suggests that repeated 
problem indicators were either missed or ignored. Thus, the Safety Board concludes that Fine 
Air’s CAS program was not as rigorous as its program description indicated and failed to result 


An STC authorizes alteration of an aircraft engine or other component that is operated under an 
approved-type certificate. 
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in the correction of systemic maintenance deficiencies. Therefore, the Safety Board believes that 
the FAA should direct the PMI assigned to Fine Air to reexamine the airline’s CAS program and 
take action, if necessary, to ensure that repetitive maintenance discrepancies are being identified 
and corrected. 

The Safety Board’s review of the accident airplane’s maintenance logs also found that all 
significant maintenance discrepancies were logged by flightcrews on return trips to Miami, where 
Fine Air’s maintenance facilities are located. No significant entries were made at any outstation 
location. The FAA PMI assigned to Fine Air told Safety Board investigators that he had “raised 
concerns” with Fine Air management about flightcrews “having all their problems on final in 
Miami,” adding that proving when the discrepancies actually occurred was impossible unless the 
inspector was accompanying the flightcrew on an en route inspection. In addition, an FAA PMI 
based in Milwaukee, Wisconsin, stated that such log entries “are common every day practice...if 
you’re passenger or freight, that’s standard.” This inspector also described the difficulty 
inspectors encounter when trying to enforce proper logbook entry procedures, asking “how do 
you do something about it [prove the entries were intentionally deferred until the return leg].” In 
the case of Fine Air, the Safety Board found no evidence that corrective action was taken by the 
airline after the PMI raised his concerns to Fine Air management and no evidence of further FAA 
followup on the matter. 

21 

During its investigation of an uncontained engine failure on a Delta Air Lines MD-88, 
the Safety Board determined that flightcrew members who found drops of oil on an engine bullet 
nose and two missing wing rivets did not have clear guidance on what constituted “maintenance 
‘discrepancies’ and ‘irregularities’ and when to contact maintenance personnel and to log 
anomalies.” Although the captain’s decision to defer maintenance in Pensacola (the departure 
airport) until arrival in Atlanta, a Delta hub, appeared to have been contrary to Delta’s FOM, 
Delta management later supported the flightcrew’s failure to log the discrepancies or to contact 
maintenance. 

The Safety Board is concerned that this return leg logging practice, which may be as 
widespread in the industry as it is difficult to verify, has become an unspoken, and largely 
tolerated, way of avoiding costly outstation repairs and flight delays. Safety Recommendation A- 
98-21, issued to the FAA as a result of the investigation of the Delta accident, was aimed at 
clarifying flightcrew responsibilities and when flightcrews “can, if at all, make independent 
determinations to depart when maintenance irregularities are noted.” The recommendation called 
for POIs to review and clarify these policies at their respective operators. However, these policies 
may differ significantly among operators. Moreover, 14 CFR Part 121.363, while outlining the 
airworthiness responsibilities of operators, contains no specific requirement to ensure that 
maintenance discrepancies are logged when they are discovered. According to 14 CFR Part 


21 National Transportation Safety Board. 1998. Uncontained Engine Failure, Delta Air Lines Flight 1288, 
McDonnell Douglas MD-88, N927DA, Pensacola, Florida, July 6, 1996. Aircraft Accident Report NTSB/AAR- 
98/01. Washington, DC. 

22 Part 121.363, “Responsibility for Airworthiness,” states that “each certificate holder is primarily 
responsible for...the airworthiness of its aircraft...[and] the performance of the maintenance, preventive 
maintenance.. .in accordance with its manual and the regulations of this chapter. 
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121.563, the pilot in command is required to “ensure that all mechanical irregularities occurring 
during flight time are entered in the maintenance log of the airplane at the end of that flight time” 
and to “ascertain the status of each irregularity entered in the log at the end of the preceding 
flight.” The Safety Board is concerned that the term “flight time” is not specifically defined, and 
could be interpreted by flight crews as meaning at the end of the last flight of a multiple-leg duty 
day, instead of at the end of the flight during which the irregularity was discovered. Part 121.563 
also does not address irregularities and specific logging responsibilities for irregularities found 
during preflight inspections. 

Faced with a maintenance irregularity at an outstation, flightcrews (under schedule 
pressures and perhaps a management preference for home-base repairs when possible) may be 
reluctant to risk the delay that a logbook entry could incur. Language addressing specific logging 
requirements in Part 121.563 (that defined specific logging requirements or stated that logging is 
mandatory, rather than referring only to the general airworthiness of the airplane) would reduce 
ambiguity. This would require flightcrews, especially at outstations, to contact maintenance for a 
deferral or a decision to seek contract maintenance repairs before departing. Although there may 
be circumstances in which independent flightcrew evaluation of maintenance discrepancies is 
warranted, maintenance personnel are the best qualified personnel to make such determinations. 
Thus, the Safety Board concludes that Fine Air’s maintenance logs for the accident airplane 
suggest a practice of logging significant maintenance discrepancies on return flights to Miami, 
where repairs were completed, and that such practices may be widespread in the industry. 
Further, the Safety Board concludes that although the PMI noted a pattern of logging entries on 
return flights to Miami and expressed his concerns to Fine Air management, no further action 
was taken either by the PMI or Fine Air management to address this problem. Therefore, the 
Safety Board believes that the FAA should amend 14 CFR Part 121.563 to specifically require 
that all discrepancies be logged when they occur and be resolved before departure through repair 
or deferral in consultation with (the certificate holder’s or contracted) maintenance personnel. 

As a result of the investigation of this accident, the National Transportation Safety Board 
recommends the following to the Federal Aviation Administration: 

Require all 14 Code of Federal Regulations Part 121 air carriers to provide 
flightcrews with instruction on mistrim cues that might be available during taxi 
and initial rotation, and require air carriers using full flight simulators in their 
training programs to provide flightcrews with Special Purpose Operational 
Training that includes an unanticipated pitch mistrim condition encountered on 
takeoff. (A-98-44) 

Conduct an audit of all Code of Federal Regulations Part 121 supplemental cargo 
operators to ensure that proper weight and balance documents are being used, that 
the forms are based on manufacturer’s data or other approved data applicable to 
the airplane being operated, and that FAA principal inspectors confirm that the 
data are entered correctly on the forms. (A-98-45) 

Require carriers operating under 14 Code of Federal Regulations Part 121 to 
develop and use loading checklists to positively verify that all loading steps have 
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been accomplished for each loaded position on the airplane and that the condition, 
weight, and sequencing of each pallet is correct. (A-98-46) 

Require training for cargo handling personnel and develop advisory material for 
carriers operating under 14 Code of Federal Regulations Part 121 and principal 
operations inspectors that addresses curriculum content that includes but is not 
limited to, weight and balance, cargo handling, cargo restraint, and hazards of 
misloading and require all operators to provide initial and recurrent training for 
cargo handling personnel consistent with this guidance. (A-98-47) 

Review the cargo loading procedures of carriers operating under 14 Code of 
Federal Regulations Part 121 to ensure that flightcrew requirements for loading 
oversight are consistent with the loading procedures in use. (A-98-48) 

Evaluate the benefit of the STAN (Sum Total Aft and Nose) and similar systems 
and require, if warranted, the installation of a system that displays airplane weight 
and balance and gross weight in the cockpit of transport-category cargo airplanes. 
(A-98-49) 

Require all principal inspectors assigned to 14 Code of Federal Regulations Part 
121 cargo air carriers to observe, as part of their annual work program 
requirements, the complete loading operation including cargo weighing, weight 
and balance compliance, flight following, and dispatch of an airplane. (A-98-50) 

Review its national aviation safety inspection program and regional aviation 
safety inspection program inspection procedures to determine why inspections 
preceding these accidents failed to identify systemic safety problems at ValuJet 
and Fine Air and, based on the findings of this review, modify these inspection 
procedures to ensure that such systemic indicators are identified and corrected 
before they result in an accident. (A-98-51) 

Evaluate the surveillance programs to ensure that budget and personnel resources 
are sufficient and used effectively to maintain adequate oversight of the operation 
and maintenance of both passenger and cargo earners, irrespective of size. (A-98- 
52) 

Require an immediate readout of all 11-parameter retrofitted flight data recorders 
(FDRs) to ensure that all mandatory parameters are being recorded properly; that 
the FDR system documentation is in compliance with the range, accuracy, 
resolution, and recording interval specified in 14 Code of Federal Regulations Part 
121, Appendix B; and require that the readout be retained with each airplane’s 
records. (A-98-53) 

Require maintenance checks for all FDRs of aircraft operated under 14 Code of 
Federal Regulations Parts 121, 129, 125, and 135 every 12 months or after any 
maintenance affecting the performance of the FDR system, until the effectiveness 
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of the proposed advisory circular and new FAA inspector guidance on continuing 
FDR airworthiness (maintenance and inspections) is proven; further, these checks 
should require air carriers to attach to the maintenance job card records a 
computer printout, or equivalent document, showing recorded data, verifying that 
the parameters were functioning properly during the FDR maintenance check and 
require that this document be part of the permanent reporting and recordkeeping 
maintenance system. (A-98-54) 

Provide FAA principal avionics inspectors with training that addresses the unique 
and complex characteristics of flight data recorder systems. (A-98-55) 

Create a national certification team of flight data recorder (FDR) system 
specialists to approve all supplemental type certificate changes to FDR systems. 
(A-98-56) 

Direct the principal maintenance inspector assigned to Fine Air to reexamine the 
airline’s continuing analysis and surveillance program and take action, if 
necessary, to ensure that repetitive maintenance discrepancies are being identified 
and corrected. (A-98-57) 

Amend 14 Code of Federal Regulations Part 121.563 to specifically require that 
all discrepancies be logged when they occur and be resolved before departure 
through repair or deferral in consultation with (the certificate holder’s or 
contracted) maintenance personnel. (A-98-58) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMEDT, 
GOGLIA, and BLACK concurred in these recommendations. 
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Since 1983, the National Transportation Safety Board has investigated 145 accidents 
involving aerial advertising/banner towing. Forty-five of the accidents (31 percent) resulted in 
37 fatalities and 11 serious injuries. A recent review of the accidents by the Safety Board 
indicated that a majority of the accidents were associated with one or more of the following 
critical flight phases, circumstances, or events: the banner pickup maneuver, entangled or 
snarled banner tow lines, and loss of engine power. 

Banner Pickup Maneuver (63 accidents) 

The banner pickup maneuver is a critical low-level maneuver performed about 20 feet 
above the ground in which, while trailing a grapple hook, the pilot flies above and between two 
upright poles about 15 to 20 feet apart. The pilot’s objective is to engage the banner tow loop 
(suspended between the poles) by applying full power and abruptly pitching the airplane upward 
just before arriving at the pickup poles. The banner, laid out on the ground, is connected to a tow 
line about 250 feet long. To lift the banner into the air and to avoid dragging it along the ground, 
the pilot exchanges speed energy for altitude, attempting to gain as much altitude as possible 
before moving the banner. The airspeed decreases rapidly during the maneuver because of the 
airplane’s nose-high pitch attitude. As the airspeed approaches the best angle-of-climb airspeed, 
the pilot must begin lowering the nose of the airplane to avoid a stall. However, for a variety of 
reasons, including inadequate pickup airspeed, excessive pitch attitude, and delay in reducing 
pitch attitude, about 50 percent of the accidents involving this maneuver result in a stall or a 
stall/spin and a subsequent collision with the ground. The fundamental problem is largely 
operational, involving banner pilot training, experience, and competence issues. 


Entangled or Snarled Banner Tow Lines (32 accidents) 

A grapple hook and cable assembly, the device used to engage the tow line during the 
banner pickup, is about 30 feet long. One end of the cable is attached to the tow release 
mechanism on the tail of the airplane adjacent to the rudder control horns. Typically, the grapple 
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hook and cable are brought forward along the side of the fuselage and through the cockpit 
window; they are stowed in the cockpit until the airplane is airborne and the pilot is ready to pick 
up the banner. The pilot then drops the hook and cable, allowing it to trail into position below 
and behind the airplane. However, if the hook and cable pass too closely to the side of the 
fuselage, the assembly sometimes becomes entangled or wrapped around the rudder control 
horns and disables the tow release mechanism. If the banner is picked up with the cable 
entangled in this manner, it causes significant loading and deflection of the rudder control horns 
and rudder, which leads the airplane to yaw severely. About 80 percent of the accidents involving 
entangled banner tow lines result in an in-flight loss of control and a subsequent collision with 
the ground or a loss of airplane performance and control during landing. 

Loss of Engine Power (31 accidents) 

A partial or total loss of engine power can occur because of fuel exhaustion, fuel 
starvation, fuel contamination, inadequate maintenance, or mechanical failure. Because typical 
banner towing operations are performed at relatively low altitudes, the loss of engine power 
usually allows the pilot little time to initiate emergency procedures, release the banner tow line, 
or position the airplane for a successful forced landing. About 40 percent of the accidents 
precipitated by loss of engine power involved in-flight collisions with objects/terrain; 20 percent 
involved an in-flight loss of control. The airplane was ditched (landed in the water) in 13 of the 
accidents. 

Banner towing operations are conducted under a certificate of waiver or authorization 
issued by the Federal Aviation Administration (FAA) in accordance with Title 14 Code of 
Federal Regulations (CFR) 91.311, “Towing-Other Than Gliders.” The respective FAA flight 
standards district office (FSDO) issuing the banner towing certificate may append special 
provisions to the certificate in the interest of safety if the operator uses nonstandard equipment or 
for other reasons such as geographical considerations, pilot limitations, air traffic control 
limitations, or weather conditions. The Safety Board is aware of one FSDO that appends special 
provisions concerning banner pilot minimal training and safety equipment to all banner towing 
certificates. 


Operators who hold a certificate of waiver or authorization have the responsibility to train 
each new pilot in banner tow operations and in the special provisions of the waiver. However, 
there are no specific regulatory requirements or other guidelines, such as an FAA advisory 
circular (AC), that uniquely address banner tow training or operations. The amount of training 
given and the training syllabus used, if any, is largely at the discretion of the individual operators. 
The FAA requires that the new banner tow pilots demonstrate proficiency by performing one 
banner pickup and drop with the maximum number of letters (panels) to be used by the 
certificate holder. However, repeated accidents involving inadequate pilot performance (failure 
to maintain airspeed, misjudgment of clearance, etc.) during the banner pickup maneuver indicate 
a lack of adequate training and proficiency in performing the maneuver under both normal and 
abnormal (entangled banner) circumstances. 
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Although very few formal or structured banner towing training courses are available, the 
Safety Board is aware of one course 1 2 that has been approved by the FAA under 14 CFR Part 
141, “Pilot Schools.” The curriculum, which contains comprehensive ground and flight training 
designed to enable pilots to safely tow commercial banners, is described as follows: 

Complete ground school on all related subjects, including FARs, waiver 
requirements, banner assembly, pre-and-post-flight of aircraft, banner tow 
equipment and banners, repair to banners and equipment, communications, 
emergency procedures, ground crew coordination and marketing. Flight training 
includes pick-up and drop procedures, in-flight emergencies involving banner 
towing, normal procedures, and abnormal procedures. Includes actual banner 
towing missions and ample practice banner pick-ups and drops. 

The lesson syllabus includes repeated low passes (over the banner pickup zone) with 
emphasis on altitude and airspeed control, maximum performance maneuvers, failure of the tow 
release mechanism, loss of rudder control, repeated pickup and drop of the banner tow line (with 
and without the banner attached), and loss of engine power with the banner attached. Because of 
the history of accidents involving banner towing, which indicates that current training procedures 
are inadequate, the Safety Board believes that the FAA should require banner tow operators to 
train new banner tow pilots using an FAA-approved banner tow training syllabus, similar to the 
one above. 

The Safety Board also believes that the FAA should issue a comprehensive aerial 
advertising/banner towing AC containing detailed information concerning FAA regulations and 
requirements; banner towing equipment and flight operations, including tow hitch and release 
mechanisms; banner assembly size and weight considerations, layout, and banner aircraft 
performance limitations; flight training guidelines/criteria for safe and efficient performance of 
the banner pickup maneuver and other phases of banner towing operations; fuel management; in¬ 
flight emergencies, including entangled/snarled banner tow lines and loss of engine power; and 
aircraft, engine, and banner equipment maintenance requirements. 

The hazards caused by banner tow lines becoming entangled with the rudder control 
horns and/or tow release mechanism can be avoided through use of simple mechanical devices. 
For example, for tail wheel airplanes with horizontal stabilizer support wires, a spring-action clip 
can be fastened to the lower stabilizer wire near the point where it joins the outboard bottom 
surface of the stabilizer. The tow cable may then be routed from the tow release mechanism 
outboard to the spring clip and then forward to the cockpit, ensuring that the cable is held away 
from the fuselage when the grapple hook and cable assembly are dropped. The weight of the 
hook and cable then pulls the cable away from the spring clip, and the cable trails normally 
behind and below the airplane. 

A second device consists of a guard attached to the bottom of the fuselage projecting 
outward and aft from either side of the fuselage. This can be fabricated from a steel rod 1/4 to 
3/8 inch in diameter bent at the center to form a “V.” A small plate welded to the rod at the bend 


1 Banner Tow Training , Kaimana Aviation, Inc., Ponca City, Oklahoma 74601. 

2 Refer to Instruction Booklet for Gasser Banner Equipment , Gasser Banner, Inc., Nashville, Tennessee 37217. 
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serves as a base for attachment to the fuselage. The length and spread of the “V” is designed so 
that a tow cable sliding along the side of the fuselage toward the rear would be deflected outward 
around the rudder control horns and clear of the steering arms and springs. 

Because these devices can prevent banner tow lines from becoming entangled with the 
rudder control horns and/or tow release mechanisms, the Safety Board believes that the FAA 
should require the installation of a mechanical safety device on the tails of tow airplanes such as 
a V-bar guard or stabilizer wire spring clip, designed to prevent entanglement of the banner 
grapple hook/cable assembly with the airplane’s rudder control horns and/or tow release 
mechanism. 

Therefore, the National Transportation Safety Board recommends that the Federal 
Aviation Administration: 

Require banner tow operators to train new banner tow pilots using an FAA- 
approved banner tow training syllabus. The training syllabus should include 
repeated low passes (over the banner pickup zone) with emphasis on altitude and 
airspeed control, maximum performance maneuvers, failure of the tow release 
mechanism, loss of rudder control, repeated pickup and drop of the banner tow 
line (with and without the banner attached), and loss of engine power with the 
banner attached. (A-98-59) 

Issue a comprehensive aerial advertising/banner towing advisory circular 
containing detailed information about FAA regulations and requirements; banner 
towing equipment and flight operations, including tow hitch and release 
mechanism, banner assembly size and weight considerations layout, and banner 
aircraft performance limitations; flight training guidelines/criteria for safe and 
efficient performance of the banner pickup maneuver and other critical phases of 
banner towing operations; fuel management; in-flight emergencies, including 
entangled/snarled banner tow lines and loss of engine power; and aircraft, engine, 
and banner equipment maintenance requirements. (A-98-60) 

Require the installation of a mechanical safety device on the tails of tow airplanes 
such as a V-bar guard or stabilizer wire spring clip, designed to prevent 
entanglement of the banner grapple hook/cable assembly with the airplane’s 
rudder control horns and/or tow release mechanism. (A-98-61) 

Chairman HALL and Members HAMMERSCHMEDT, GOGLIA, and BLACK concurred 
in these recommendations. Vice Chairman FRANCIS concurred with recommendation A-98-60, 
but disapproved recommendations A-98-59 and -61. 
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National Transportation Safety Board 

Washington, D.C. 20594 

Safety Recommendation 


Date: July 31, 1998 

In reply refer to: A-98-62 through 64 


Honorable Jane F. Garvey 
Administrator 

Federal Aviation Administration 
Washington, D.C. 20591 


On February 17, 1998, the right main landing gear (MLG) of a Boeing 757-200 (757) 
airplane, operated by Canada 3000 on an intended passenger charter flight from Brussels, 
Belgium, to Montreal, Canada, collapsed while the airplane was taxiing for takeoff at Brussels 
International Airport. None of the occupants were injured and the airplane sustained minor 
damage. The airplane had accumulated 11,450 cycles and 42,196 hours in 8 years and 9 
months of service. 

The National Transportation Safety Board is participating in the Belgian Civil Aviation 
Administration’s investigation of the incident, in accordance with the provisions of Annex 13 
to the Convention on International Civil Aviation. Postincident examination of the right MLG 
revealed a circumferential fracture on its truck beam, which had broken into two large 
sections. The examination of the fracture surfaces revealed intergranular stress corrosion 
cracking (SCC) emanating from corrosion pits on the lower inside diameter of the truck beam. 
Examination of the inside surface of the truck beam revealed multiple localized areas where 
the primer painted on the inside surface had deteriorated, bubbled-up, or was missing. 

The 757 MLG is a conventional, four-wheel, dual-tandem landing gear that has a 
metering pin orifice shock strut (see figure 1). The gear has four support points: the forward 
trunnion, the aft trunnion, the drag brace, and the side strut. The shock strut outer cylinder of 
the MLG assembly transfers operational loads from the truck assembly to the four support 
points. The assembly consists of a truck beam, axles, wheels and tires, brake rods, and a 
protective shield. The truck beam is the primary supporting member of the truck assembly. It 
pivots on the lower end of the shock strut outer cylinder. 
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OUTER CYLINDER 



TRUCK ASSEMBLY CONFIGURATION 


Figure 1. Boeing 757 Main Landing Gear Assembly 

The truck beam is a hollow cylinder made from 4340M steel. The inner surface has 
three primary means of corrosion protection: cadmium-titanium electroplating; Boeing 
Material Specification BMS10-11 type 1 primer; and MIL-C-11796 Class 1 corrosion- 
inhibiting compound (CIC), also called Cosmoline. This CIC is applied in a hot liquid form 
and coats the inner surface of the truck beam with a uniform layer. Any moisture in the truck 
beam is drained through an opening at the aft end of the cylindrical truck beam section by 
gravity during truck tilt during takeoff. 

The Safety Board’s materials laboratory examined the right MLG truck beam and found 
three anomalies: missing primer, missing CIC, and a plugged drainage opening. About 75 
percent of the inner surface of the truck beam was missing CIC, exposing the primer. There 
were localized spots of corrosion and exposed bare metal where the primer was missing. The 
primer was missing primarily on the bottom inner surface of the truck beam. In this area, 
some remaining primer had bubbled up and could easily be scraped off. Both ends of the 
truck beam contained approximately 2-inch diameter globules of CIC and grease. These 
globules and a dirt/grease mixture had clogged the truck beam’s drainage opening. 

The examination of the fracture surfaces disclosed a 0.9-inch wide region that showed 
characteristics of SCC. The primer was missing on the inner surface of the truck beam in the 
SCC area. Scanning electron microscope examination of the 0.9-inch wide SCC fracture 
region disclosed intergranular features, typical of SCC in 4340M steel, that emanated from 
three corrosion pits on the inner diameter surface. These corrosion pits measured no more 
than 0.01 inch deep by 0.01 inch diameter. The rest of the fracture area exhibited river pattern 
features characteristic of overstress. 
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Examination of the left MLG of the incident airplane at the overhaul facility revealed 
large globules of grease and CIC clogging the truck beam drainage opening similar to that 
found in the right MLG. The CIC had separated from the inner surface and there were patches 
of corrosion and areas where the primer was missing. The surface corrosion on the inner 
surface of the left MLG truck beam was more extensive than that found on the right MLG. 

Boeing records indicate no other 757 MLG truck beam failures from SCC. Following 
this incident, the Safety Board contacted various 757 MLG overhaul facilities and was 
informed that typically 757 MLGs are inspected and overhauled after 8 to 10 years of service. 
Boeing’s Maintenance Planning Document 1 for the 757 recommends the 
disassembly/restoration of the MLG between 12,000 and 18,000 cycles, or 10 years, 
whichever occurs first. The overhaul facilities informed the Safety Board that at overhaul, 
almost all 757 MLG truck beam inner surfaces exhibit patches of corrosion, but the primer and 
CIC are normally present. The overhaul facilities reported that globules of grease and CIC 
had not been found in any MLG truck beam that they had overhauled. The overhaul facilities 
reported that the truck beam drainage opening was found clogged in some MLGs that had been 
brought in for overhaul, but Boeing has informed the Safety Board that there have been a few 
isolated cases in which the CIC has separated from the truck beam inner surface and the 
primer has remained intact. 

According to Boeing, if the CIC or primer separates from the inner surface, the 
corrosion protection capability is reduced. Also, if the gravity drain opening is clogged, the 
truck beam will retain ingested moisture creating an environment conducive to corrosion and 
SCC. The 757 maintenance manual does not specify a way to determine the condition of the 
corrosion protection layers (i.e., CIC and primer) or the gravity drainage opening of the MLG 
truck beam before overhaul. Because moisture is one of the primary causes of corrosion and 
can easily be ingested into the truck beam, it is important to eliminate it by preventing the 
drain opening from becoming blocked. Therefore, the Safety Board believes that the Federal 
Aviation Administration (FAA) should require operators of 757s to conduct periodic 
inspections of the MLG truck beam to ensure that the drainage opening at the aft end of the 
beam is unobstructed. 

The balling up of the CIC and the loss of the primer from the interior surface of the 
truck beam resulted in the corrosion protection deteriorating over much of the surface of the 
beam, including the area where the stress corrosion cracking initiated. The presence of 
moisture and aggressive contaminants trapped within the beam by blockage of the drainage 
opening probably accelerated the deterioration of the corrosion protection and created an 
environment that led to the initiation of the stress corrosion cracking. A periodic visual 
inspection of the truck beam inner surface is important to detect the condition of the CIC and 
primer to minimize the possibility of corrosion or SCC in the beam. Also, to ensure detection 
of corrosion and cracking on the inner surface of the 757 truck beam, a nondestructive 


1 The Boeing Maintenance Planning Document provides general guidance to airlines in the formulation and 
establishment of individual maintenance programs. 
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inspection (NDI) technique should be developed and implemented. The Safety Board is aware 
that Boeing and other operators have developed NDI techniques to detect corrosion and cracks 
in the trunnion bore of the 767 MLG, and the FAA has mandated the inspection. 2 A similar 
technique could be developed to detect corrosion and cracks on the inner surface of 757 truck 
beams. Because no inspection methods currently exist to detect the condition of the CIC and 
primer or corrosion and cracks in the truck beam, the Safety Board believes that the FAA 
should develop and require the periodic use of visual and NDI techniques to evaluate the 
condition of CIC and primer and to detect corrosion and cracks on the inner surface of the 757 
MLG truck beam. 

Boeing has not yet completed its analysis of samples of the CIC and primer from the 
Canada 3000 incident airplane MLG truck beam to determine the reasons for reduction in its 
corrosion protection capabilities. It is important that the FAA monitor the progress of that 
analysis and take appropriate actions accordingly. Therefore, the Safety Board believes that 
the FAA should monitor Boeing’s testing and analysis of the Canada 3000 MLG truck beam 
CIC and primer and, after the reasons for the reduction in its corrosion protection capabilities 
are determined, take corrective action to ensure that 757 MLG truck beams have adequate 
corrosion protection. 

Therefore, the National Transportation Safety Board recommends that the Federal 
Aviation Administration: 

Require operators of Boeing 757s to conduct periodic inspections of the 
main landing gear truck beam to ensure that the drainage opening at the aft 
end of the beam is unobstructed. (A-98-62) 

Develop and require the periodic use of visual and nondestructive inspection 
techniques to evaluate the condition of corrosion inhibiting compound and 
primer and to detect corrosion and cracks on the inner surface of the Boeing 
757 main landing gear truck beam. (A-98-63) 

Monitor the Boeing Commercial Airplane Group’s testing and analysis of 
the Canada 3000 main landing gear truck beam corrosion inhibiting 
compound and primer and, after the reasons for the reduction in its 
corrosion protection capabilities are determined, take corrective action to 
ensure that Boeing 757 main landing gear truck beams have adequate 
corrosion protection. (A-98-64) 


2 See Safety Board recommendations A-95-101 and -102, issued on October 27,1995, which addressed a Boeing 
767 right MLG trunnion failure in Hamburg, Germany. 




Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA, and BLACK concurred in these recommendations. 
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In reply refer to: A-98-65 through -66 


Honorable Jane F. Garvey 
Administrator 

Federal Aviation Administration 
Washington, D.C. 20591 


On January 5, 1997, a Fairchild Aircraft SA227-AC, N165SW, equipped with two 
AlliedSignal (formerly Garrett Turbine Engine Company) TPE331-11U-612 turbopropeller 
engines, experienced an ice-induced dual-engine flameout. 1 The flight had originated at Long 
Beach, California, as an on-demand Title 14 Code of Federal Regulations Part 135 air taxi 
passenger fli ght to Grand Canyon Airport, Tusayan, Arizona. The weather at Grand Canyon 
Airport had deteriorated below the allowable landing minimums, requiring the pilot to execute a 
missed approach. The airplane was subsequently diverted to the Bullhead City Airport, Bullhead, 
Arizona, and was on final approach when both engines flamed out. The pilots were unable to 
restart the engines, so they executed a forced landing 1.5 miles south of the Bullhead City Airport, 
which ca u sed substantial damage to the airplane. The two pilots sustained minor injuries; none of 
the 19 passengers were injured. 

Weather data for the Grand Canyon and Bullhead City airports indicated that the airplane 
had flown in moist air with temperatures at minus 5°C. The pilots stated that they observed ice 
accumulating on the airplane wings while flying en route to the Grand Canyon Airport and they 
had cycled the deice boots 2 to shed the ice. However, they stated that they did not activate the 
engine’s override ignition system or the engine inlet heat as required by procedures in the 
airplane’s flight manual (AFM) for flight-in-icing conditions. The Safety Board concluded that 
the dual-engine flameout was caused by ice ingestion and by the pilots’ failure to select engine 
override ignition as required when flying in icing conditions. (See enclosed accident brief.) 


1 An ice-induced flameout is the unintentional termination of combustion that occurs when ice or slush 
momentarily interrupts airflow to the engine causing an over-rich fuel/air mixture within the engine’s combustion 
chamber. 

2 Deice boots are inflatable rubber tubes that are attached along the wing’s leading edge. After a nominal amount 
of ice accumulates, the pilot inflates the boots, which breaks away tire ice from the leading edge of the wing. 
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On April 1, 1993, a Fairchild Aircraft SA227-TT, N500AK, equipped with two 
AlliedSignal TPE331-10U-513G turbopropeller engines, experienced a dual-engine flameout and 
crashed while the pilot was performing an instrument landing system approach to the Tri-City 
Regional Airport, Blountville, Tennessee. The airplane was destroyed, and all four people on 
board were killed. 

Weather at the time of the accident was reported as light rain, fog, temperature 7°C, dew 
point 5°C, and a visibility of 6 miles. Additionally, several pilots landing at the Tri-City Airport 
about the time of the accident reported light-to-moderate rime icing between 5,000 and 14,000 
feet. 


During the Safety Board’s investigation of this accident, it was discovered that neither 
engine was rotating and the propellers were feathered at impact. Additionally, examination of the 
pilot’s annunciator panel revealed that both engine and propeller heat “ON” captions were 
illuminated at impact, indicating that the pilot had turned these systems on, most likely when he 
became aware of the ice accumulation. The ignition switch panel was destroyed by fire; therefore, 
the positipns of the ignition switches could not be determined. The Safety Board concluded that 
both engines stopped operating before impact because of simultaneous flameouts or flameouts in 
rapid succession caused by ice ingestion and that the flameouts most likely occurred because the 
pilot did not follow the approved procedures for icing conditions as specified in the AFM. (See 
enclosed accident brief.) The feathered propellers indicated that the pilot recognized the dual¬ 
engine flameout situation and was attempting to restart the engines. The AFM provides a single¬ 
engine restart procedure but does not provide a dual-engine restart procedure. The Safety Board 
concludes that AFM procedures are necessary to provide pilots proper guidance if a dual-engine 
flameout occurs. 

Conditions for engine and airframe ice formation are ideal when the outside air 
temperature is approximately 10°C or below with visible moisture (with a temperature/dew point 
spread of 3°C or greater). However, engine inlet duct icing can occur without airframe icing at 
ambient temperatures above freezing when intake air is drawn into the engine rather than being 
rammed in, such as when an airplane is climbing at low speed and high power. The suction 
reduces the static air pressure within the inlet duct, causing the incoming air to expand and cool to 
subfreezing temperatures. Under those conditions, with outside air temperatures well above 
freezing, ingested water vapor will freeze and be deposited in the engine inlet duct. The pilot may 
not recognize the potential for engine inlet icing conditions and may not anticipate the need to 
take specific actions to prevent an engine flameout. 

Most TPE3 31-powered airplanes have a pilot-activated engine anti-ice system to prevent 
the accumulation of ice in the engine inlet duct. When selected by the pilot, the anti-ice system 
directs hot engine bleed air to the engine inlet lip to prevent ice formation in the engine inlet. This 
system is designed to be activated before ice accumulation; it is not intended as a deicing system. 
Activation of the anti-ice system after ice has accumulated can cause pieces of ice to shed from 
the inlet lip and cause an engine flameout. As an added flameout protection, some 
TPE331-powered Fairchild airplanes incorporate an “automatic” ignition system (see right side of 
figure 1) that can detect a flameout and automatically activate the ignition system. This system is 
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not truly automatic because the pilot must first select an ignition mode using a manually selectable 
three-position switch. Flameouts can be detected by the decay in certain engine parameters, such 
as engine revolutions per minute or torque. The automatic ignition system can relight the engine 
without pilot action or awareness of any engine or airplane performance changes if the ignition 
mode switch is in the automatic position. 


Ignition for engine start 


Continuous ignition 
when on the ground 
weight-on-wheels 
activated 



Continuous ignition 
during all flight 
conditions 


Ignition for engine start 



Off 

Continuous 

Automatic 


Continuous ignition 
during all flight 
conditions 


Automatic ignition 
when a flameout is 
sensed (May be used 
to start engine) 


Continuous Ignition System Automatic Ignition System 


Figure 1. Typical Ignition Switch Position Labeling in TPE331-powered Airplanes 


The Fairchild Aircraft ignition system installed in the Bullhead City and Blountville 
accident airplanes did not incorporate the automatic ignition system but a “continuous” ignition 
system (see left side of figure 1), which provides continuous ignition in flight when the pilot 
selects the “override” mode using a similar three-position switch. The Fairchild SA227-AC and 
SA227-TT airplane AFMs state that in advance of intentionally flying into icing conditions and 
heavy rain, the pilot should select engine and propeller heat and override ignition. The procedures 
for inadvertent flight-into-icing conditions state that after discovering ice accumulation, the pilot 
should select “override” ignition, then engine and propeller heat for one engine (to ensure that the 
engine is operating satisfactorily), and then engine and propeller heat for the other engine. 

To address reports of ice-induced dual-engine flameouts in TPE331 engines, from 1982 
through 1986, Garrett introduced two improved ignition system exciters, 3 and also issued various 


3 Garrett has introduced improvements that have increased the exciter duty cycle from 5 minutes to 1 hour to 
unlimited. All three of these exciter systems are still in use in TPE3 31-powered airplanes in the United States. 
The exciter serves to convert either AC or DC low-voltage power to a high-voltage potential for delivery to the 
igniter plug. 
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operating information letters 4 to emphasize the proper use of engine anti-ice and to provide 
additional information on the proper use of engine ignition systems in icing conditions. 
Additionally, on July 8, 1985, following a January 8, 1985, dual-engine flameout incident in 
Covington, Kentucky, the Safety Board issued Safety Recommendations A-85-50 through -52 to 
the Federal Aviation Administration (FAA) to require that Fairchild relabel the ignition switch 
positions on SA226 and SA227 airplanes to remove any ambiguity with regard to the ignition 
switch position, to issue an air carrier operations bulletin (ACOB) to advise operators of the 
appropriate use of the continuous ignition mode, and to require that Fairchild revise the SA226 
and SA227 AFMs to include a warning to place the engine ignition system in the continuous 
mode during flight-into-icing conditions. 

On December 15, 1986, the FAA responded to the Safety Board’s recommendations by 
issuing Airworthiness Directives (ADs) 86-24-11 and 86-25-04, which required revision of 
Fairchild Aircraft SA226 and SA227 AFMs to include the new warnings and procedures for 
flight-into-icing conditions, and issuing an ACOB with procedures to prevent engine flameout 
during and after flight into heavy precipitation or icing conditions, but did not relable the switch 
positions. The Safety Board classified the recommendation to relabel the switch positions 
“Closed—Acceptable Alternate Action” because it believed the AFM changes regarding engine 
heat and continuous ignition eliminated the ambiguity of when to use each ignition mode. 

The FAA also issued several ADs for other TPE331-powered airplanes, such as those 
manufactured by Beech, Domier, Gulfstream, Mitsubishi, British Aerospace, and Pilatus 
Britten-Norman. 5 The ADs addressed flight limitations, engine ignition systems, engine flameout 
protection, placards, increased duty-cycle exciter units, automatic ignition systems, and changes 
to the AFMs. 

The Safety Board is aware of 25 reported incidents of ice-induced engine flameouts of 
TPE331-powered airplanes since 1974. Many of these were dual-engine flameouts. Despite 
changes mandated by the ADs, the Bullhead City and the Blountville accidents show that these 
improvements do not prevent all ice-induced flameouts. 

The accident data show that pilots may fail to recognize icing conditions and to take 
appropriate action to prevent ice-induced engine failures. Pilots can easily misinterpret icing 
conditions when the temperature is well above freezing, especially at night when they may be 
unable to observe ice formations. The data show that many ice-induced flameouts occur during 
approach and landing, which are periods of high crew workload. In all of these circumstances it is 
difficult for the pilot to recognize icing conditions and then to manually select the appropriate 
ignition switch position. The Safety Board is concerned that the current ignition system designs 


4 On April 30, 1985, Garrett issued Operating Information Letter 01 331-11. After April 30, 1985, AlliedSignal 
reissued Operating Information Letter 01 331-11R1 in February 1988, 01 331-11R2 in November 1993, and 01 
331-11R3 in April 1997. Additionally, on November 15, 1994, AlliedSignal issued Pilot Advisory Letter 331- 
04R1 regarding ice-induced dual-engine flameouts. 

5 Beech-AD 86-24-09, December 15, 1986; Domier-AD 96-09-14, June 11, 1996; Gulfstream (Aero Commander)- 
AD 87-24-07R1, February 9, 1988; Mitsubishi-AD 84-12-04, AD 86-26-02, AD 96-25-02, dated June 29, 1984, 
December 31, 1986, December 12, 1996, respectively; British Aerospace-AD 86-24-10, December 15, 1986; 
Pilatus Britten-Norman-AD 91-05-09, March 25, 1991. 



5 


in TPE3 31-powered airplanes still leave those airplanes susceptible to ice-induced engine 
flameouts. Therefore, the Safety Board believes that the FAA should require that all TPE331- 
powered airplanes be equipped with an engine ignition system that is activated automatically 
(without pilot input) following an engine flameout. Because no dual engine flameout procedures 
are in the AFMs and many of the 25 reported ice-induced flameouts were dual-engine, as an 
interim measure, until an automatically activated ignition system is installed, the Safety Board 
believes that the FAA should require that the AFMs or pilot’s operating handbooks for all 
TPE331-powered airplanes be modified, if necessary, to incorporate dual-engine failure or 
flameout procedures. 

Therefore, the National Transportation Safety Board recommends that the Federal 
Aviation Administration: 

Require that all TPE3 31-powered airplanes be equipped with an 
engine ignition system that is activated automatically (without pilot 
input) following an engine flameout. (A-98-65) 

As an interim measure, until an automatically activated ignition 
system is installed, require that the airplane flight manuals or pilot’s 
operating handbooks for all TPE331-powered airplanes be 
modified, if necessary, to incorporate dual-engine failure or 
flameout procedures. (A-98-66) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA and BLACK concurred in these recommendations. 
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Briaf of Accident (Continued) 
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National Transportation Safety Board 

Washington, D.C. 20594 

Safety Recommendation 


Date: August 11, 1998 

In reply refer to: A-98-67 through -70 


Honorable Jane F. Garvey 
Administrator 

Federal Aviation Administration 
Washington, D.C. 20591 


On September 6, 1997, a Saudi Arabian Airlines (Saudia) Boeing 737-200, powered by 
two Pratt & Whitney (P&W) JT8D-15 engines, experienced an uncommanded acceleration of the 
No. 2 (right) engine during takeoff roll at Najran, Saudi Arabia. The captain reported that he 
noticed that the exhaust gas temperature (EGT) overtemperature light for the No. 2 engine was 
illuminated during the takeoff roll at approximately 110 knots. The captain reduced thrust on the 
No. 2 engine, but the EGT indication remained at the maximum EGT limit. The takeoff was 
rejected and the thrust levers were retarded to idle; however, the No. 2 engine remained at a high 
power level. Further attempts to retard the power were unsuccessful and the airplane departed 
the left side of the runway, resulting in damage to the landing gear and separation of the No. 2 
engine. Four of the 79 passengers sustained minor injuries during the evacuation, and the airplane 
was destroyed by a postcrash fire. The National Transportation Safety Board is participating in the 
Presidency of Civil Aviation of the Kingdom of Saudi Arabia’s investigation in accordance with the 
provisions of Annex 13 to the Convention on International Civil Aviation. 

The fuel pump and fuel control for the No. 2 engine were removed and later disassembled 
during an inspection. Included in the JT8D engine fuel pump assembly is a splined control shaft 1 
that transmits the N 2 2 signal from the fuel pump to the fuel control. The control shaft is splined 
on one end where it mates with the fuel pump and on the opposite end where it mates with the 
fuel control. Although damage to the housing precluded a bench test of the fuel control, no wear 
of the mating splines between the fuel control and the control shaft was observed. However, the 
splines where the control shaft mates with the fuel pump were almost completely stripped. This 
damage allowed the splines of the fuel pump gear shaft to rotate past the splines of the control 
shaft. 


1 A shaft containing a set of integral keys, or teeth, that fit within corresponding grooves on a mating shaft or gear. 

2 Rotational speed of the high-pressure compressor. The N 2 signal is one of several inputs used by the fuel control 
to schedule fuel delivery. 
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Following a series of control shaft spline failures in the late 1970s attributed to 
misalignment of the control shaft, Argo-Tech Corporation, the manufacturer of JT8D fuel pumps, 
conducted tests on the fuel pump to determine the cause of the failures. The testing indicated that 
torque generated during operation of the pump was causing misalignment between the control 
shaft and the mating gear in the fuel pump, which was leading to premature wear of the control 
shaft splines. To address this problem, Argo-Tech issued Service Bulletin (SB) 73-34 on 
January 15, 1980. The SB specifies a 0.0036-inch lateral shift of the fuel pump’s gear train to 
reduce control shaft spline wear problems (with no tolerance allowed). Records indicated that 
after installation of a new control shaft on the fuel pump from the Saudia airplane in 1993, the 
gear train was offset per the SB by an overhaul facility. However, postaccident measurement 
showed that the centerline shift of the gear train was 0.0030 inch, which is outside the allowable 
tolerance. The pump had been operated 3,237 hours since the SB modification. 

The centerline shift recommended by SB 73-34 was established to reduce wear of the 
control shaft splines caused by misalignment resulting from normal operation. The SB is 
applicable to all JT8D-1 through -15 engines, which are installed on Boeing 727, 737-100/-200, 
and DC-9 series airplanes, but is not required. The SB action was incorporated as a production 
modification on all JT8D-17 engines and -200 engines. JT8D-17 engines are installed on some 
Boeing 727-200, 737-200, and DC-9-50 series airplanes. JT8D-200 engines are installed on 
advanced 727-200 and MD-80 series airplanes. 

The Safety Board requested information from P&W and Boeing on incidents involving 
known or suspected 3 fuel pump control shaft failures on JT8D engines. P&W’s database 
contained 39 incidents since 1980 in which JT8D control shaft malfunctions were involved or 
suspected. Of the 26 incidents reported by Boeing on 727, 737, and DC-9 airplanes, only 6 also 
appear on the P&W list. It is not known how many of the reported control shaft failures included 
pumps that had previously been modified per SB 73-34. However, the data provided by P&W 
include two incidents involving JT8D-17 engines, indicating that even fuel pumps with the SB 
modification incorporated during original production might be susceptible to control shaft spline 
wear. 


Argo-Tech stated that it is aware of three confirmed fuel pump failures related to 
misalignment of the control shaft. Argo-Tech’s database, which only dates back to 1993, also 
shows that four of the fuel pumps returned to its facilities contained excessive (90 to 100 percent) 
control shaft spline wear. It should be noted that at least 10 control shaft spline failures were 
reported in 1978 before the issuance of SB 73-34 and that the frequency of failure or excessive 
wear of the control shaft might be higher because of a lack of reporting. 

The incidents involving the JT8D fuel pump malfunctions have occurred during takeoff, 
climb, cruise, descent, and approach flight segments. The Safety Board is aware of two U.S. 
incidents that have occurred since the Saudia accident. The most recent incident occurred on 
October 17, 1997, and involved a Delta Airlines Boeing 727, equipped with JT8D-15 engines, 
that experienced an uncommanded acceleration of the No. 1 engine during cruise flight. The 


3 Incidents in which an uncommanded thrust increase or a loss of power lever control occurred. 
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engine pressure ratio (EPR) 4 reportedly increased to 2.4 during the incident. The engine did not 
respond to throttle inputs, and the crew shut down the engine and diverted from their scheduled 
landing at New York’s La Guardia Airport to New York’s John F. Kennedy International Airport. 
Although no problems were found during a bench check of the engine’s fuel pump and fuel 
control, subsequent examination of the fuel pump revealed wear of the control shaft splines. 
Delta indicated that SB 73-34 had been incorporated on their entire fleet of affected airplanes, 
including the incident airplane. However, the cause of the control shaft spline wear was not 
determined. 

To further address wear of control shaft splines on JT8D fuel pumps, Argo-Tech issued 
SB 73-40 on May 4, 1998. The SB provides information to replace existing control shafts with a 
new control shaft made from through-hardened Hll steel. The new material offers better 
resistance to spline wear and should increase the control shaft’s service life. The new control 
shaft was introduced into service under a controlled service use (CSU) program with two 
operators. As part of the CSU program, one of the control shafts was removed for examination 
after approximately 2,600 hours of operation; no wear of the shaft splines was detected. 

P&W recommends that the fuel pump receive a bench test at 6,000 flight hours and an 
overhaul at 12,000 flight hours. Argo-Tech indicated that some airlines establish their own times 
between overhauls but that most fuel pumps are repaired or inspected only when they 
malfunction. Consequently, control shaft damage is not likely to be detected before failure. 

The lack of required periodic fuel pump inspections and continuing problems related to 
control shaft spline wear indicate that action should be taken to ensure proper alignment and 
reduce wear of the fuel pump control shaft on all JT8D engines. Therefore, the Safety Board 
believes that the FAA should require that the fuel pumps on all P&W JT8D engines be modified in 
accordance with Argo-Tech SBs 73-34 and 73-40 to reduce operating misalignment of the 
control shaft and wear of the shaft splines. In addition, although incorporation of the SB 
modification should substantially address spline wear of the control shaft, recurrent inspections of 
the control shaft should also be required because of shaft wear or failure involving fuel pumps that 
had previously been modified per SB 73-34 and because long-term performance of the new 
control shaft has not been demonstrated. Pumps that have not been modified per the SBs should 
be subject to more frequent inspections. Accordingly, the Safety Board believes that the FAA 
should require recurrent inspections of the fuel pump control shaft on all P&W JT8D engines and 
replacement of control shafts exhibiting spline wear. Fuel pumps that have not been modified per 
SBs 73-34 and 73-40 should be subject to more frequent inspections. 

The Safety Board is also concerned about a design feature incorporated on JT8D engine 
fuel controls called “zero speed protection.” Zero speed protection occurs when the N 2 signal to 
the fuel control is lost, which results in an automatic shift in the fuel delivery schedule on the 
affected engine to approximately 90 to 95 percent takeoff power. When this occurs, engine thrust 
no longer responds to throttle movements. Fracture of the fuel pump control shaft or severe wear 
of the shaft splines will result in complete loss of the N 2 signal to the fuel control. 


4 The ratio of turbine exhaust pressure to fan inlet pressure. 
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According to P&W, the zero speed protection feature was incorporated to ensure that the 
engine would deliver high thrust during a critical flight phase following loss of the N 2 signal to the 
fuel control. Although the function of an automatic engine response such as this may be beneficial 
at takeoff, there are situations in which such a feature could lead to asymmetric thrust and 
directional control difficulties, including landing, taxi, and engine reverse operations. Directional 
control difficulties could also be exacerbated by contaminated runway surfaces or during any 
operation near other aircraft. In addition, because this type of engine response can occur 
whenever the engine is being started or operated, a potential hazard to personnel exists during 
operations at the gate or during maintenance activities. 

A partial loss of the N 2 signal, which can occur if the control shaft splines are severely 
worn, can also trigger a shift in the fuel delivery schedule. A partial loss of the N 2 signal would be 
interpreted by the fuel control as a low-speed signal and would result in an increased fuel flow to 
regain the targeted N 2 , which might also cause an exceedance of N 2 , EPR, and EGT limits. The 
only method of reducing thrust after partial or complete loss of the N 2 signal is to shut off fuel to 
the affected engine through the fuel cutoff lever or the fire handle. 

Identification of a failure in which zero speed protection engages might initially be difficult 
because the resulting thrust on the affected engine might differ little from the thrust requirements 
at the time of failure. However, when zero speed protection results in a large deviation from the 
desired thrust setting, quick and proper action by the flightcrew may be required to maintain 
directional control of the airplane. The Safety Board is concerned that flightcrews might not be 
properly informed about the zero speed protection feature and its effect on throttle authority. 

A review of Saudia’s 737 flight handbook, as well as flight manuals for the other affected 
airplanes, revealed no reference to the zero speed protection feature. Boeing has indicated that 
the zero speed protection feature is not addressed in its flight manuals for 727, 737, DC-9, and 
MD-80 airplanes. Following the Saudia accident, P&W issued an all operators wire on 
November 20, 1997, to recommend that all personnel operating JT8D-powered airplanes be 
informed about the zero speed protection feature and the corresponding ineffectiveness of the 
throttle. The only operator information issued by Boeing has been In-Service Activities Report 
(ISAR) 93-07, which was issued to 737 operators in 1993 following an in-flight event in which a 
fractured fuel pump shaft caused the loss of throttle lever control, and ISAR 97-24, which was 
issued to 737 operators in December 1997 following the Saudia accident. However, the ISARs 
offered only a minimal review of the circumstances of the accident and the zero speed protection 
feature. The Safety Board believes that the FAA should issue a flight standards information 
bulletin to the principal operations inspectors of all operators of 737-100/-200, 727, DC-9, and 
MD-80 airplanes informing the operators about the circumstances of the Saudia accident and the 
zero speed protection feature on P&W JT8D engines. The information should note the 
ineffectiveness of the throttle following engagement of zero speed protection. 

P&W has further indicated that incorporation of the zero speed protection feature is not 
unique to the JT8D engine. The same philosophy is incorporated on JT3D and JT9D engine fuel 
controls and may also be incorporated on other in-service engine models. It is not known 
whether or to what extent this type of failure and engine response is addressed in crew training 
programs and flight manuals for airplanes equipped with other engine types. Therefore, the 
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Safety Board believes that the FAA, in conjunction with representatives from engine and airframe 
manufacturers and pilot groups, should address the issue of automatic engine response following 
the loss of inputs such as the N 2 signal by studying events in which uncommanded and 
uncontrollable engine power excursions have occurred and, based on the results of the study, 
make appropriate recommendations that address the following: 1) automatic engine response 
following the loss of certain inputs; and 2) crew operating and training issues related to 
uncommanded engine power excursions in which the throttle is ineffective. 

Therefore, the National Transportation Safety Board recommends that the Federal 
Aviation Administration: 

Require that the fuel pumps on all Pratt & Whitney JT8D engines be modified in 
accordance with Argo-Tech Service Bulletins 73-34 and 73-40 to reduce operating 
misalignment of the control shaft and wear of the shaft splines. (A-98-67) 

Require recurrent inspections of the fuel pump control shaft on all Pratt & Whitney 
JT8D engines and replacement of control shafts exhibiting spline wear. Fuel 
pumps that have not been modified per Argo-Tech Service Bulletins 73-34 and 
73-40 should be subject to more frequent inspections. (A-98-68) 

Issue a flight standards information bulletin to the principal operations inspectors 
of all operators of Boeing 737-100/-200, 727, DC-9, and MD-80 airplanes 
inf orming the operators about the circumstances of the Saudi Arabian Airlines 
Boeing 737 accident and the zero speed protection feature on Pratt & Whitney 
JT8D engines. The information should note the ineffectiveness of the throttle 
following engagement of zero speed protection. (A-98-69) 

In conjunction with representatives from engine and airframe manufacturers and 
pilot groups, address the issue of automatic engine response following the loss of 
inputs such as the N 2 signal by studying events in which uncommanded and 
uncontrollable engine power excursions have occurred and, based on the results of 
the study, make appropriate recommendations that address the following: 1) 
automatic engine response following the loss of certain inputs; and 2) crew 
operating and training issues related to uncommanded engine power excursions in 
which the throttle is ineffective. (A-98-70) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA, and BLACK concurred in these recommendations. 
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4007 th Street, S.W. 

Washington, D.C. 20590 


About 0554 eastern daylight time, 1 on September 5, 1996, a Douglas DC-10-10CF, 
N68055, operated by the Federal Express Corporation (FedEx) as flight 1406, made an 
emergency landing at Stewart International Airport, Newburgh, New York, after the flightcrew 
determined that there was smoke in the cabin cargo compartment. The flight was operating 
under the provisions of Title 14 Code of Federal Regulations (CFR) Part 121 as a cargo flight 
from Memphis, Tennessee, to Boston, Massachusetts. Three crewmembers and two nonrevenue 
passengers were aboard the airplane. The captain and flight engineer sustained minor injuries 
while evacuating the airplane. The airplane was destroyed by fire after the landing. 

The National Transportation Safety Board determined that the probable cause of this 
accident was an in-flight cargo fire of undetermined origin. 2 

Prohibited Items On Board the Accident Airplane 

After the fire, investigators discovered a DNA synthesizer in cargo container 6R that 
contained small quantities of flammable liquids (including acetonitrile and tetrahydrafuran). 
These chemicals are classified by the Research and Special Programs Administration as 
■» hazardous materials and are therefore subject to Department of Transportation (DOT) 

requirements for packaging, labeling, and shipping documentation to accurately identify the 
hazardous nature of the shipment. However, because the synthesizer was not intended to be 
shipped with any hazardous materials, it was shipped as general freight and was not packaged or 
labeled in accordance with those requirements and was not accompanied by the required 
paperwork. 


1 Unless otherwise indicated, all times are eastern daylight time, based on a 24-hour clock. 

2 National Transportation Safety Board. 1998. In-Flight Fire/Emergency Landing, Federal Express Flight 
1406, Douglas DC-10-10, N68055, Newburgh, New York, September 5, 1996. Aircraft Accident Report 
NTSB/AAR-98/03. Washington, DC. 
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Several other items discovered on board the accident airplane might also have constituted 
shipments of undeclared hazardous materials. Seven aerosol cans and several plastic bottles 
containing acidic or alkaline liquids that could be corrosive, and two samples containing 
potentially flammable or combustible liquids were found in the cargo debris. 3 Although the 
original contents of the aerosol cans recovered from the accident aircraft could not be 
determined, aerosol cans, as pressurized containers with compressed gases, are regulated 
hazardous materials. The acidic and alkaline liquids in the plastic bottles were also likely subject 
to the DOT hazardous materials regulations as corrosive materials. Although the DOT hazardous 
materials regulations allow exceptions to packaging, marking, labeling, or shipping paper 
requirements, depending on the quantity and form of the material being shipped, these exceptions 
generally are not applicable when the item is being transported by air. Consequently, the aerosol 
cans and the containers of acidic liquid likely constituted undeclared shipments of hazardous 
materials. Although these items were ruled out as possible ignition sources of the fire, they again 
raise concerns about the prevalence of unknown hazardous materials being carried on board 
airplanes. 

The ease with which prohibited materials can find their way onto commercial airplane 
flights was further highlighted by the discovery of several illegal shipments of marijuana on 
board the accident flight. Marijuana is not classified as a hazardous material for purposes of air 
transportation, and the marijuana found on board flight 1406 was not a factor in the accident. 
Further, the Safety Board notes that most undeclared shipments of hazardous materials are 
unintentional, although the shipment of marijuana is clearly a deliberate attempt to ship 
contraband material. Nonetheless, the Safety Board concludes that the presence of the aerosol 
cans, the containers of acidic liquid, as well as several packages of marijuana on board the 
accident flight illustrates that common carriers can be unaware of the true content of many of the 
packages they carry. 

Federal and Industry Oversight 

The shipment of undeclared and improperly packaged hazardous materials on board 
airplanes and the oversight by the Federal Aviation Administration (FAA) and air carriers to 
detect and identify such shipments was most recently addressed by the Safety Board in its report 
of the May 11, 1996, accident involving ValuJet Airlines. The Safety Board determined that the 
in-flight fire was initiated by the actuation of one or more chemical oxygen generators being 
improperly carried as cargo. These generators had not been identified as hazardous materials and 
were not properly packaged for transportation. 

The Safety Board stated in the ValuJet report that the practices, procedures, and training 
of the personnel involved in the identification and handling of undeclared hazardous materials 
have remained inadequate. The Safety Board further noted that the ValuJet accident and 
incidents that occurred after that accident clearly demonstrate that the shipment of undeclared 


The hazardous materials regulations define a corrosive material as “a liquid or solid that causes full 
thickness destruction of human skin at the site of contact within a specified period of time; [or a] liquid that has a 
severe corrosion rate on steel or aluminum.” (49 CFR 173.136.) They also prescribe packaging standards based on 
the length of exposure of the corrosive material to human skin and the time after exposure for destruction of the skin 
to occur. (49 CFR 173.137.) 
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hazardous materials in air transportation is a serious problem that has not been adequately 
addressed. In the ValuJet report, the Safety Board further stated the following: 

[T]the FAA has initiated the evaluation requested by the Safety Board in Safety 
Recommendations A-96-25 and -26 of the practices and training provided by all air 
carriers for accepting passenger baggage and freight shipment (including COMAT 
[company materials]) and for identifying undeclared or unauthorized hazardous 
materials that are offered for transport and, based on this evaluation, to require air 
carriers to revise as necessary their practices and training in this area. 

Further, the FAA is developing a hazardous materials education and enforcement 
program that will focus on air freight forwarders. Also, shortly after August 1996, the 
FAA issued, under 14 CFR Part 109 (Indirect Air Carrier Security), shipper 
endorsement requirements that require all shippers, and freight forwarders to certify 
that all packages being shipped do not contain unauthorized explosives, destructive 
devices, or hazardous materials. Signing the endorsement also gives permission to 
search the shipment. Because the transport of oxygen generators has continued since 
the accident, despite the regulations, the Safety Board will closely monitor the FAA’s 
progress in fulfilling these proposed improvements. 

The FAA initiatives that have been undertaken since the ValuJet accident (e.g., hiring 
new agents, comprehensive inspections of carriers’ and shippers’ facilities, increased penalties 
for violations, a renewed outreach program, and the establishment of a database for trend 
analysis) are positive measures to reduce the number of hidden or undeclared shipments of 
hazardous materials. However, although the Safety Board supports these efforts, this accident 
illustrates that there is continued cause for concern. The Safety Board is especially concerned 
that, except in the case of properly packaged and declared shipments of hazardous materials, 
carriers generally do not inquire about the content of packages being shipped domestically, nOr 
are they required to do so. The Safety Board also notes that the dangerous goods managers for 
FedEx and the FAA questioned the practicality and usefulness of carriers questioning a shipper 
about the contents of packages offered for shipment. Although air carriers and the FAA 
apparently agree on the seriousness of the problem, consideration is not being given to innovative 
measures, such as identifying package contents on the airbills or using technologies like x-ray 
machines to detect undeclared hazardous materials. 

The Safety Board concludes that transportation of undeclared hazardous materials on 
airplanes remains a significant problem and more aggressive measures to address it are needed. 
Thus, the Safety Board believes that, in addition to the efforts already underway by the, FAA, the 
DOT should require, within 2 years, that a person offering any shipment for air transportation 
provide written responses, on shipping papers, to inquiries about hazardous characteristics of the 
shipment, and develop other procedures and technologies to improve the detection of undeclared 
hazardous materials offered for transportation. The inquiries may include answering individual 
and specific questions about whether a package contains a substance that might be classified 
hazardous, (e.g., “does this package contain a substance that might be corrosive [or flammable, a 
poison, an oxidizer, etc.]”) 
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As a result of the investigation of this accident, the National Transportation Safety Board 
recommends that the Department of Transportation: 

Require, within 2 years, that a person offering any shipment for air transportation 
provide written responses, on shipping papers, to inquiries about hazardous 
characteristics of the shipment, and develop other procedures and technologies to 
improve the detection of undeclared hazardous materials offered for 
transportation. (A-98-71) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA, and BLACK concurred in these recommendations. 


By: 








National Transportation Safety Board 

Washington, D.C. 20594 
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Honorable Jane F. Garvey 
Administrator 

Federal Aviation Administration 
Washington, D.C. 20591 

About 0554 eastern daylight time, 1 on September 5,1996, a Douglas DC-10-10CF, N68055, 
operated by the Federal Express Corporation (FedEx) as flight 1406, made an emergency landing at 
Stewart International Airport (Stewart), Newburgh, New York, after the flightcrew determined that 
there was smoke in the cabin cargo compartment. The flight was operating under the provisions of 
Tide 14 Code of Federal Regulations (CFR) Part 121 as a cargo flight from Memphis, Tennessee, to 
Boston, Massachusetts. Three crewmembers and two nonrevenue passengers were aboard die 
airplane. The captain and flight engineer sustained minor injuries while evacuating the airplane. The 
airplane was destroyed by fire after the landing. 

The National Tr ans portation Safety Board determined that the probable cause of this 

• • 2 

accident was an in-flight cargo fire of undetermined origin. 

Crew Coordination 

Although the airplane was landed successfully, several required items were not accomplished 
during the descent and landing. The flight engineer failed to perform step No. 6 of the “Cabin Cargo 

Smoke Light Illuminated” checklist (pulling the cabin air shutoff T-handle). tf he had done so, 
airflow would have been shut off to the main cargo deck area while being maintained to the cockpit. 
The Safety Board concludes that the flight engineer’s failure to pull the cabin air shutoff T-handle, as 
required by the “Cabin Cargo Smoke Light Illuminated” checklist, allowed the normal circulation of 
air to continue to enter the main cargo area, thereby providing the fire with a continuing source of 
oxygen and contributing to its rapid growth. However, the Safety Board could not determine the 
degree to which it might have contributed to the severity of the fire. 


1 Unless otherwise indicated, all times are eastern daylight time, based on a 24-hour clock. 

2 National Transportation Safety Board. 1998. In-Flight Fire/Emergency Landing, Federal Express Flight 
1406, Douglas DC-10-10, N68055, Newburgh, New York, September 5, 1996. Aircraft Accident Report 
NTSB/ AAR-98/03. Washington, DC. 

3 Although the cockpit voice recorder (CVR) recorded the flight engineer stating, “pull cabin air” at 
0538:40, its position after the accident indicates that the cabin air shutoff T-handle had not been pulled. 
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The flight engineer also failed to complete step No. 7 of the “Cabin Cargo Smoke Light 
Illuminated checklist (to maintain a 0.5 psi differential cabin pressure). As a result, the occupants 
were unable to immediately open and exit from the primary evacuation exits (the LI and R1 doors) 
because the airplane was still pressurized. The flight engineer acknowledged that instead of 
manually maintaining the appropriate pressure differential, after he had placed the outflow valve 
control in the manual position, he only “cranked it open a couple of times [turns].” Because they 
were at 33,000 feet and operating on only one pressurization pack, the outflow valve would have 
been almost completely closed before the flight engineer cranked it. As demonstrated in the Safety 
Board s test on a similar DC-10, manually cranking the outflow valve control two times will not 
perceptibly open the outflow valve from fully closed on a static airplane. The Safety Board 
concludes that the evacuation was delayed because the flightcrew failed to ensure that the airplane 
was properly depressurized. 


The CVR transcript reveals that the flight engineer was overloaded and distracted from his 
attempts to accomplish the “Fire & Smoke” and “Cabin Cargo Smoke Light Illuminated” emergency 
checklists (in addition to his normal descent and before-landing checklist duties) by his repeatedly 
asking for the three-letter identifier for Stewart so that he could obtain runway data for that airport. 

After the accident, the captain said that he had allowed the first officer to continue flying the 
airplane during the emergency so that he could coordinate with air traffic control and work with the 
flight engineer on completing the checklists. This should have resulted in an effective 
apportionment of the workload among the three crewmembers, in that the flying pilot would not 
have been overly distracted from flying the airplane, the flight engineer would have received needed 
assistance with his duties, and the captain would have had the opportunity to oversee the actions of 
both. However, the Safety Board is concerned that, despite the captain’s stated intention to serve in 
a monitoring and coordinating role, he failed to provide sufficient oversight and assistance to ensure 
completion of all necessary tasks. 

The captain did not call for any checklists to address the smoke emergency, which was 

contrary to FedEx procedures. 5 (The flight engineer initiated the "Fire & Smoke" and "Cabin Cargo 
Smoke Light Dluminated” checklists.) Nor did he explicitly assign specific duties to each of the 
crewmembers. The captain also did not recognize the flight engineer’s failure to accomplish 
required checklist items, provide the flight engineer with effective assistance, or intervene to adjust 
or prioritize his workload. In fact, the captain repeatedly interrupted the flight engineer during his 

attempts to complete the “Fire & Smoke” checklist, 6 thereby distracting him further from those 
duties. 


At the time of the accident, the flight engineer had only 188 hours as a DC-10 flight engineer and had 
been working for FedEx for less than 6 months. 

The FedEx DC-10 Flight Manual indicates, under “Emergency and Abnormal Checklist Procedures,” that 
Phase One [memory]” items are to be “performed when directed by the Captain.” Further, it states, “all checklists 
containing Phase One items should be requested by the Captain by name” and strongly recommends that the captain 
and flight engineer “work together on the review of the Phase One items and the accomplishment of the Phase Two 
items.” 

At 0538:38 and 0539:13, the captain interrupted him to ask whether he had run a test on the smoke 
detector system, which is not an item listed on the checklist. 
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Further, the captain did not initiate the “Emergency Evacuation” checklist, which was 
required to be initiated during the preparation for landing. The “Emergency Evacuation” checklist 
includes depressurizing the airplane before landing. If this checklist had been initiated, it would 
have provided another opportunity for the crew to accomplish the necessary depressurization that 
was missed on the “Fire & Smoke” checklist. In addition, the captain told investigators that he did 
not initiate the emergency descent checklist, but said he thought he had accomplished the items on 
that checklist by memory. Although the emergency descent checklist (titled “Rapid 
Depressurization/Emergency Descent”) was probably not applicable to this situation, the captain s 
statement is troubling because it suggests a belief that checklist items can be adequately 
accomplished from memory alone. Finally, the CVR transcript indicates that the captain did not call 
for an emergency evacuation. (After the captain said “we need to get...out of here, the flight 
engineer said “emergency ground egress.”) 

The Safety Board concludes that the captain did not adequately manage his crew resources 
when he failed to call for checklists or to monitor and facilitate the accomplishment of required 
checklist items. Therefore, the Safety Board believes that the Federal Aviation Administration 
(FAA) should require the principal operations inspector (POI) for FedEx to review the crew’s actions 
on the accident flight and evaluate those actions in the context of FedEx emergency procedures and 
training (including procedures and training in crew resource management) to determine whether any 
changes are required in FedEx procedures and training. 

Crew’s Use of Emergency Equipment 

Within 48 seconds after the first indication of a problem, the crew donned oxygen masks, as 
required by the “Fire & Smoke” checklist. The captain elected not to don his smoke goggles because 
they did not fit over his eyeglasses and they were dirty and scratched. The first officer elected not to 
wear his smoke goggles because he felt that they unduly restricted his peripheral vision. The flight 
engineer put his smoke goggles on but subsequently removed them because there was no smoke in 
the cockpit. 

The Safety Board is concerned that cockpit smoke may affect crewmembers’ vision, 
imperiling their ability to operate the airplane or properly address the emergency. Evidence in this 
accident indicates that smoke did not enter the cockpit in significant amounts until after the crew 
landed and stopped the airplane. However, the Safety Board is concerned that under different 
circumstances, the failure of crewmembers to don smoke goggles or to keep the goggles on during an 
emergency could adversely affect the outcome. 

In connection with its investigation of the May 11, 1996, accident involving ValuJet flight 
592, 7 the Safety Board concluded that there is inadequate guidance for air carrier pilots about the 
need to don oxygen masks and smoke goggles immediately in the event of a smoke emergency. In 
Safety Recommendation A-97-58, the Safety Board asked the FAA to issue guidance on this point to 
air carrier pilots. In a November 17, 1997, response, the FAA indicated it would issue a flight 
standards handbook bulletin in November 1997 containing guidance on procedures to don protective 
breathing equipment (PBE) for smoke and fume protection. The FAA did not issue the bulletin. 


7 National Transportation Safety Board. 1997. In-flight Fire and Impact with Terrain, ValuJet 
Airlines Flight 592, DC-9-32, N904VJ, Everglades, near Miami, Florida, May II, 1996. NTSB/AAR-97/06. 
Washington, DC. 



4 


Recently, it has been learned that the bulletin will not be issued until after the FAA reviews the 
results of a special emphasis inspection of smoke goggles during en route and ramp inspections. On 
March 20, 1998, the FAA called for this special survey of smoke goggles as part of its response to 
Safety Recommendation A-97-60 (also from the ValuJet report), which sought a requirement that 
smoke goggles currently approved for use by the flightcrews of transport-category aircraft be 
packaged in such a way that they can be easily opened by the flightcrew. The survey has been 
completed, and the FAA is reviewing the results. The Board has been assured that the FAA is still in 
agreement with the intent of the recommendations addressing flightcrew smoke goggles and that 
action on Safety Recommendations A-97-58, -59, and -60 will follow the results of the survey. The 
Board is very concerned that the issuance of the guidance bulletin regarding the need for flightcrews 
to don smoke goggles at the first indication of a possible in-flight smoke or fire emergency has been 
delayed until after the completion and review of the special survey. Based on this delay, the Board 
classifies Safety Recommendation A-97-58 “Open—Unacceptable Response.” 

In the ValuJet report, the Safety Board also concluded that the smoke goggle equipment 
currently provided on most air carrier transport aircraft requires excessive time, effort, attention, and 
coordination by the flightcrew to don and, in Safety Recommendation A-97-59, asked the FAA to 
establish a performance standard for the rapid donning of smoke goggles and ensure that all air 
earners meet this standard through improved smoke goggle equipment, improved flightcrew training, 
or both. In response, the FAA indicated that it believed the intent of this recommendation is 
addressed in 14 CFR 121.337, which establishes standards for PBE for smoke and fume protection 
and requires that the equipment be conveniently located on the flight deck and easily accessible for 
immediate use. However, there is no standard for the optimum equipment location that will 
facilitate quick donning of such equipment or for the time required to don the equipment. The FAA 
also stated that it would issue a flight standards handbook bulletin to provide additional guidance on 
the location and donning of this equipment and procedural guidance on flightcrew training 
requirements. .However, it did not address the recommendation to establish a standard to ensure that, 
through equipment design, equipment installation, or flightcrew training, a specific performance 
standard is achieved for donning smoke goggles. The FAA has indicated that it will await the results 
of the special emphasis inspection before it takes further action. The Safety Board classifies Safety 
Recommendation A-97-59 “Open—Unacceptable Response.” 

This accident again demonstrates that crews may not use the equipment currently available 
and that some characteristics of the current equipment may interfere with the flightcrew’s 
performance of its duties. Accordingly, the Safety Board reiterates Safety Recommendations A-97- 
58 and -59. 

During the evacuation, the flight engineer stated that before he entered the foyer area to 
evacuate via the R1 door, he filled his lungs with oxygen from his oxygen mask. He did not use the 
PBE, which would have provided him with protection from the smoke while he attempted to open 
the foyer doors. In postaccident interviews, he stated that he was anxious to open the exit doors 
quickly, and he forgot that the PBE was available. The Safety Board concludes that crewmembers 
who do not use PBE during a smoke or fire emergency may place themselves at unnecessary risk in 
attempting to address or escape from the situation. Although most carriers’ emergency evacuation 
checklists instruct crewmembers to don PBE when circumstances warrant, there is no reference to 
the PBE in the FedEx “Emergency Evacuation” checklist. Therefore, the Safety Board believes that 
the FAA should require FedEx to modify its evacuation checklist and training to emphasize the 
availability of PBE during evacuations in an environment containing smoke, fire, or toxic fumes. 
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The L-l door was not available as an emergency exit because it only opened partially as a 
result of the flight engineer’s attempt to open the door while the airplane was still pressurized. When 
there is no electric power to the airplane the motor that operates the door is powered by a charged air 
bottle. If an attempt is made to open the door when the cabin pressure differential is above 0.5 psi, 
the bottle pressure will bleed off and the door will not open. Although the lack of the L-l door as an 
escape route was not a significant factor in this accident, the Safety Board is concerned that under 
other circumstances the loss of a passenger exit door could have serious safety consequences. The 
Safety Board concludes that crewmembers may not be adequately aware that attempting to open a 
passenger exit door when the airplane is still pressurized may result in the door not opening. 
Therefore, the Safety Board believes that the FAA should require all Part 121 operators of airplanes 
that rely on air pressure to operate exit doors to make crewmembers aware of the circumstances of 
this accident and remind them of the need to ensure that the airplane is depressurized before 
attempting to open the passenger exit doors in an emergency. 

Dissemination of Hazardous Materials Information 

After the occupants had successfully evacuated the airplane, the most immediate problem for 
the firefighters and other emergency responders was to prevent the fire from spreading and involving 
the fuel that remained on the airplane. In this case, the unavailability to the incident commander of 
specific information about the declared hazardous materials on board did hot affect the firefighting 
strategy of the New York Air National Guard (NY ANG). Nevertheless, in accidents that involve 
hazardous materials, it is critical that firefighters and other emergency responders receive timely 
information regarding the identity, quantity, number of packages, and location of declared hazardous 
materials. Such information can influence the type and level of response and may be necessary to 
adequately protect emergency response personnel, the environment, and the surrounding 
communities. 

Neither the assistant fire chief who served as the initial incident commander nor the ANG 
fire chief received specific information during the firefighting phase of the emergency (before 0925) 
about the identity of the hazardous materials, their quantities, or the number of packages on the 
airplane. By 0700, about 1 hour after the airplane had landed, the only information about the 
hazardous materials on board the airplane that had been provided to the initial incident commander 
came from the Part A form and a handwritten list provided by the FedEx station at the airport. This 
information indicated only the hazard classes of the hazardous materials on board the airplane and 
their location in the airplane by cargo container position. Emergency guidance about specific 
chemicals was available through the Orange County Hazardous Materials Response Team (HMRT) 
and its communications link to CHEMTREC; however, this information was of little use until the 
specific identity and quantities of the declared hazardous materials on board the airplane were 
known. About 0915, approximately 10 minutes before the fire was extinguished, the fire chief 
received from the Orange County HMRT coordinator a copy of the weight and load plan and a 
handwritten list identifying some of the chemicals on board. 

The NY ANG and other participating emergency response agencies, including airport 
operations at Stewart, repeatedly requested specific information about the hazardous materials on 
board the airplane. Throughout the morning (beginning at 0635) and into the early afternoon, 
FedEx, primarily through its Global Operations Command Center in Memphis, faxed as many as 12 
transmissions of various hazardous materials shipping documents to the emergency operations center 
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(EOC) at the airport operations building and the New York State Police barracks at Stewart, 
although many of the faxes were illegible. However, none of these reached the incident commander. 

Another problem was that FedEx did not have the capability to generate, in a timely manner, 
a single list indicating the shipping name, identification number, hazard class, quantity, number of 
packages, and the location of each declared shipment of hazardous materials on the airplane. To 
prepare such a list, FedEx would have had to compile information from copies of all of the 
individual Part Bs for each individual shipment of hazardous materials on the airplane. Because 
FedEx did not have the capability to quickly consolidate that information, it relied on faxing copies 
of the individual Part Bs for the approximately 85 hazardous materials packages on board, which 
proved to be burdensome, time consuming and, in this case, ineffective. Also, because of the poor 
quality and legibility of many of the handwritten Part Bs, much of the information was unusable. 


In contrast, railroads operating freight trains can generate a computerized list of all of the 
freight cars in the train that identifies which freight cars are transporting hazardous materials and 
provides the shipping name, hazard class, identification number, and type of packaging, quantity, and 
emergency response guidance for each hazardous material transported. Such a printed, 
comprehensive list can be generated quickly and thus the information can be provided in a timely 
fashion to the appropriate emergency responders and in a more useful format than numerous faxed 
copies of partially legible Part B forms. 

In both this accident and the July 31, 1997, crash of the FedEx MD-11 at Newark, the on¬ 
board Part B hazardous materials shipping papers were not available to emergency responders, 8 and 
FedEx was unable to provide complete information to emergency responders in a timely manner. 
Further, in two subsequent accidents (one near Clarksville, Tennessee, on March 5, 1998, and the 
other at Bismarck, North Dakota, on April 7, 1998), the effectiveness of FedEx’s hazardous 
materials recordkeeping system was again called into question. In the Clarksville accident, the 
shipping papers on board the airplane and on file at FedEx’s Memphis Operations Center were found 
to be inaccurate. And in the Bismarck accident, FedEx was unable to confirm whether there were 
hazardous materials on board the airplane until 2 hours and 49 minutes after receiving the request for 
this information. 

Safety Board investigators surveyed the capability of other carriers to provide this 
information in similar circumstances and found that only one carrier had an on-line capability to 
provide detailed information about the hazardous materials on board its airplane. The remaining 
earners, like FedEx, rely on paper copies of the hazardous material shipping documentation retained 
at the departing station if the on-board documentation is destroyed. The Safety Board is pleased that 
FedEx has committed to developing and implementing an electronic system for tracking and 
retrieving information about hazardous materials being carried on board FedEx flights. FedEx plans 
to implement intermediate and long-term plans that would make computerized information about 
hazardous materials information available from all FedEx facilities. However, the Safety Board does 
not agree with FedEx’s position that the proper shipping name is not relevant to emergency 
responders. Although this information may not always be required, in many cases it may be vital 

g 

The DOT hazardous materials regulations [49 CFR Part 173] require that the proper shipping name, 
hazard class, identification number, packaging group, and total quantity of the material appear on the shipping papers 
for any shipment of hazardous materials. Further, the regulations stipulate [49 CFR Part 175] that an operator must 
provide this information in writing to the pilot-in-command and that a copy of the shipping papers must accompany 
the shipment on board the airplane. 
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that emergency responders know exactly what substances are on board an aircraft so that appropriate 
measures can be taken to address potential risks. 

Compared to the other modes of transportation, it is less likely that shipping papers on board 
an accident aircraft will survive or be accessible because of the greater likelihood of fire and 
destruction of the airplane. Because of the danger of fire, a flightcrew is also less likely to have time 
to retrieve the shipping papers after a crash. The Safety Board concludes that the DOT hazardous 
materials regulations do not adequately address the need for hazardous materials information on file 
at a carrier to be quickly retrievable in a format useful to emergency responders. Therefore, the 
Safety Board believes that the FAA and the Research and Special Programs Administration should 
require, within 2 years, that air carriers transporting hazardous materials have the means, 24 hours 
per day, to quickly retrieve and provide consolidated, specific information about the identity 
(including proper shipping name), hazard class, quantity, number of packages, and location of all 
hazardous materials on an airplane in a timely manner to emergency responders. 

Another obstacle in this case to emergency responders receiving hazardous materials 
information was FedEx’s inappropriate statement to the ANG command post (at about 1300) that 
copies of the hazardous materials shipping documentation could not be provided to them because the 
Safety Board had taken over the investigation. This created the false impression that such 
information could not be released without the Safety Board’s approval. FedEx later stated that this 
was consistent with company policy that once the Safety Board has taken control of an aircraft 
accident investigation, all information pertaining to that investigation should be forwarded to the 
Safety Board. Although the Safety Board appreciates FedEx’s efforts to recognize the Board’s 
primacy in aircraft accident investigations, the Safety Board has not promoted, nor does it support, a 
policy that would interfere with a carrier’s ability to assist emergency responders in transportation 
emergencies, especially when hazardous materials are involved. The Safety Board concludes that 
FedEx’s policy of providing information only to the Safety Board after the Safety Board initiates an 
investigation is inconsistent with the need to quickly provide emergency responders with essential 
information to assess the threat to themselves and the local community. Therefore, the Safety Board 
believes that the FAA should require the POI for FedEx to ensure that all FedEx employees who may 
communicate with emergency responders about a transportation accident involving hazardous 
materials understand that they should provide those emergency responders with any available 
information about hazardous materials that may be involved. 

Emergency Response 

Postaccident evaluations by airport personnel and representatives of the participating 
agencies indicated that many believed that communication and coordination among the agencies 
were lacking during the emergency response. Although all participating agencies recognized the 
ANG fire chief as the incident commander, 9 representatives from these agencies had differing 
opinions about who was to be present at the EOC, who was in charge at the EOC, the role of other 
agencies (including the Safety Board), and which emergency plan had been implemented in this 
accident. Although each of the participating agencies has conducted drills and exercises under their 
respective emergency plans for transportation and nontransportation hazardous materials incidents, 
joint exercises had not been conducted at Stewart for a simulated hazardous materials incident. The 


9 


The assistant fire chief on duty served as incident commander until 0700, when the fire chief arrived on 


scene. 
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failure of the incident commander to receive the hazardous materials information that was being 
provided to other emergency responders indicates that communication and coordination among the 
participating agencies were not effective. Further, inadequate emergency preplanning and 
coordination among the responding emergency response agencies resulted in confusion about the 
responsibilities of the participating agencies and contributed to the failure of information about the 
hazardous materials on the airplane to reach the incident commander. 

The Safety Board concludes that more effective preparation for emergencies involving 
hazardous materials and a system for coordination among the ANG, Stewart International Airport 
management, and all local and State emergency response agencies are needed. The Safety Board 
recognizes that after this accident Stewart revised its emergency plan, and that airport operations 
personnel at Stewart have acknowledged the need to address those deficiencies in the airport’s 

emergency plan. However, the Safety Board is concerned that FAA requirements 10 do not 
specifically address the need to prepare for hazardous materials emergencies, and that other airports 
may be similarly unprepared for hazardous materials emergencies. The Safety Board concludes that 
airport emergency plans should specifically address hazardous materials emergencies. Therefore, the 
Safety Board believes that the FAA should require all certificated airports to coordinate with 
appropriate fire departments, and all State and local agencies that might become involved in 
responding to an aviation accident involving hazardous materials, to develop and implement a 
hazardous materials response plan for the airport that specifies the responsibility of each 
participating local, regional, and State agency, and addresses the dissemination of information about 
the hazardous materials involved. Such plans should take into consideration the types of hazardous 
materials incidents that could occur at the airport based on the potential types and sources of 
hazardous materials passing through the airport. The Safety Board also believes that the FAA should 
require airports to coordinate the scheduling of joint exercises to test these hazardous materials 
emergency plans. 

Firefighters were positioned on scene before the airplane landed and began firefighting 
efforts immediately. Although the firefighters initially attempted to conduct an interior attack on the 
fire from the foyer area, the location of the cargo containers prevented them from approaching the 
seat of the fire. After the cargo door was opened, firefighters observed orange flames and heavy 
smoke in the airplane, and the incident commander evacuated them from the airplane. The initial 
incident commander’s decision to evacuate the firefighters from the interior of the airplane was 
appropriate given the danger posed by the smoke and fire-filled airplane. However, the initial 
incident commander acknowledged that use of the skin penetrator agent application tool to penetrate 
the fuselage was delayed while he attempted to accommodate the flight engineer’s request that 

damage to the airplane be minimized. 11 Although it is not clear whether an earlier entry would have 
improved the effectiveness of the firefighting efforts in this case, the Safety Board is concerned that 
more aggressive measures to enter the airplane, such as use of a fuselage penetrating tool, were not 
taken sooner. The Safety Board notes that the ANG fire chief testified that based on “lessons 
learned” from this accident, if a similar situation were to occur, he would immediately “get right in 
there with a hand line and deploy some type of penetrating tool on the outer skin of the aircraft.” 


14 CFR 139.325 specifies what must be included in airport emergency plans of airports certificated under 

Part 139. 

The assistant fire chief who served as the initial incident commander testified that at the flight engineer’s 
suggestion a telephone call was placed to the airplane manufacturer (Douglas) in an unsuccessful attempt to 
determine whether there were alternate means for entering the airplane. 
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The Safety Board has long been concerned about the lack of success of airport fire 

departments in extinguishing interior fires. 12 On June 4, 1996, the FAA published “Airport Rescue 
and Firefighting Mission Response Study,” in the Federal Register and invited comments from 
interested parties. According to the Federal Register notice, the study was undertaken to compare 
the mission and requirements for civil airport fire services to those of the Department of Defense. 
On August 1,1996, the Safety Board commented: 

[T]he current mission set forth in 14 CFR Part 139 to “provide an escape path from a 
burning airplane” no longer suffices. The Safety Board supports a full study of the 
mission statement by the FAA with a view towards providing adequate [aircraft rescue 
and firefighting (ARFF)] resources to rapidly extinguish aircraft interior fires and to 
extricate aircraft occupants from such interior fires. All aspects of this issue, including 
staffing, extinguishing agents, firefighter training, and response times, should be 
evaluated and compared with DOD standards to develop a broader mission statement that 
includes interior cabin fire suppression and extrication of aircraft occupants. 

Accident history suggests that the environment inside a burning airplane’s interior may be 
beyond the current technological capabilities of fire departments to extinguish within adequate time 
frames to successfully evacuate occupants or protect cargo. The Safety Board is aware that the FAA 
has researched fire extinguishing systems for airplane interiors, including testing of a water spray 
system that would discharge water into a particular area of the airplane when triggered by sensors in 
that area. Because the system would discharge water only to a focused area of potential fire, it 
would minimize the total amount of water that would need to be carried on board, thereby reducing 
the weight penalty of such a system. FAA tests showed that when this system was used to fight a 
fire, it delayed the onset of flashover, reduced cabin air temperatures, improved visibility, and 
increased potential survival time. 

The Safety Board is concerned about the number of losses that have occurred and concludes 
that currently, inadequate means exist for extinguishing on-board aircraft fires. Therefore, the Safety 
Board believes that the FAA should reexamine the feasibility of on-board airplane cabin interior fire 
extinguishing systems for airplanes operating under 14 CFR Part 121 and, if found feasible, require 
the use of such systems. 

The Safety Board realizes that requiring on-board extinguishing systems may not entirely 
resolve these safety concerns because they may become disabled by crash impacts. Further, the 
Safety Board realizes that the full implementation of such technology will require a number of years. 
Therefore, the Safety Board concludes that in addition to the safety benefits provided by on-board 
extinguishing systems, ARFF capabilities must also be improved so that firefighters are able to 
extinguish aircraft interior fires in a more timely and effective manner. Therefore, the Safety Board 
believes that the FAA should review the aircraft cabin interior firefighting policies, tactics, and 


12 Air Canada DC-9-32 in Covington, Kentucky, June 2, 1983 (23 persons killed by smoke/and or fire); 
US Air 737 collision with a Sky west Fairchild Metro 227 in Los Angeles, California, on February 1, 1991 (22 
persons killed by smoke/and or fire); Northwest Airlines DC-9 collision with a Northwest 727 in Detroit, Michigan, 
on December 3, 1990 (eight persons killed by smoke and/or fire); Air Transport International DC-8-62 in Jamaica, 
New York, on March 12, 1991 (freight only); Ryan International Airlines B-727 in Hartford, Connecticut, on May 3, 
1991 (freight only); and TWA Lockheed L1011 in Jamaica, New York, on July 30, 1992. 
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procedures currently in use, and take action to develop and implement improvements in firefighter 
training and equipment to enable firefighters to extinguish aircraft interior fires more rapidly. 

As a result of the investigation of this accident, the National Transportation Safety Board 
recommends that the Federal Aviation Administration: 

Require the principal operations inspector for Federal Express (FedEx) to review the 
crew’s actions on the accident flight and evaluate those actions in the context of 
FedEx emergency procedures and training (including procedures and training in crew 
resource management) to determine whether any changes are required in FedEx 
procedures and training. (A-98-72) 

Require Federal Express to modify its evacuation checklist and training to emphasize 
the availability of protective breathing equipment during evacuations in an 
environment containing smoke, fire, or toxic fumes. (A-98-73) 

Require all Part 121 operators of airplanes that rely on air pressure to open exit doors 
to make crewmembers aware of the circumstances of this accident and remind them 
of the need to ensure that the airplane is depressurized before attempting to open the 
passenger exit doors in an emergency. (A-98-74) 

Require, within 2 years, that air carriers transporting hazardous materials have the 
means, 24 hours per day, to quickly retrieve and provide consolidated, specific 
information about the identity (including proper shipping name), hazard class, 
quantity, number of packages, and location of all hazardous materials on an airplane 
in a timely manner to emergency responders. (A-98-75) 

Require the principal operations inspector for Federal Express (FedEx) to ensure that 
all FedEx employees who may communicate with emergency responders about a 
transportation accident involving hazardous materials understand that they should 
provide those emergency responders with any available information aboutTiazardous 
materials that may be involved. (A-98-76) 

Require all certificated airports to coordinate with appropriate fire departments, and 
all State and local agencies that might become involved in responding to an aviation 
accident involving hazardous materials, to develop and implement a hazardous 
materials response plan for the airport that specifies the responsibility of each 
participating local, regional, and State agency, and addresses the dissemination of 
information about the hazardous materials involved. Such plans should take into 
consideration the types of hazardous materials incidents that could occur at the 
airport based on the potential types and sources of hazardous materials passing 
through the airport. Airports should also be required to coordinate the scheduling of 
joint exercises to test these hazardous materials emergency plans. (A-98-77) 

Reexamine the feasibility of on-board airplane cabin interior fire extinguishing 
systems for airplanes operating under 14 Code of Federal Regulations Part 121 and, if 
found feasible, require the use of such systems. (A-98-78) 



Review the aircraft cabin interior firefighting policies, tactics, and procedures 
currently in use, and take action to develop and implement improvements in 
firefighter training and equipment to enable firefighters to extinguish aircraft interior 
fires more rapidly. (A-98-79) 

Additionally, the Safety Board reiterates the following recommendations to the FAA: 

Issue guidance to air carrier pilots about the need to don oxygen mask and smoke 
goggles at the first indication of a possible in-flight smoke or fire emergency. 
(A-97-58) 

Establish a performance standard for the rapid donning of smoke goggles; then 
ensure that all air carriers meet this standard through improved smoke goggle 
equipment, improved training, or both. (A-97-59) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA, and BLACK concurred in these recommendations. 




National Transportation Safety Board 

Washington, D.C. 20594 

Safety Recommendation 


Date: August 12, 1998 
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Ms. Kelley S. Coyner 

Office of the Administrator 

Research and Special Programs Administration 

400 7 th Street, S.W. 

Washington, D.C. 20590 

About 0554 eastern daylight time, 1 on September 5, 1996, a Douglas DC-10-10CF, 
N68055, operated by the Federal Express Corporation (FedEx) as flight 1406, made an 
emergency landing at Stewart International Airport (Stewart), Newburgh, New York, after the 
flightcrew determined that there was smoke in the cabin cargo compartment. The flight was 
operating under the provisions of Title 14 Code of Federal Regulations (CFR) Part 121 as a cargo 
flight from Memphis, Tennessee, to Boston, Massachusetts. Three crewmembers and two 
nonrevenue passengers were aboard the airplane. The captain and flight engineer sustained minor 
injuries while evacuating the airplane. The airplane was destroyed by fire after the landing. 

The National Transportation Safety Board determined that the probable cause of this 

2 

accident was an in-flight cargo fire of undetermined origin. 

After the occupants had successfully evacuated the airplane, the most immediate problem 
for the firefighters and other emergency responders was to prevent the fire from spreading and 
involving the fuel that remained on the airplane. In this case, the unavailability to the incident 
commander of specific information about the declared hazardous materials on board did not 
affect the firefighting strategy of the New York Air National Guard (NY ANG). Nevertheless, in 
accidents that involve hazardous materials, it is critical that firefighters and other emergency 
responders receive timely information regarding the identity, quantity, number of packages, and 
location of declared hazardous materials. Such information can influence the type and level of 
response and may be necessary to adequately protect emergency response personnel, the 
environment, and the surrounding communities. 

Neither the assistant fire chief who served as the initial incident commander nor the ANG 
fire chief received specific information during the firefighting phase of the emergency (before 


1 Unless otherwise indicated, all times are eastern daylight time, based on a 24-hour clock. 

2 National Transportation Safety Board. 1998. In-Flight Fire/Emergency Landing, Federal Express Flight 
1406, Douglas DC-10-10, N68055, Newburgh, New York September 5, 1996. Aircraft Accident Report 
NTSB/AAR-98/03. Washington, DC. 
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0925) about the identity of the hazardous materials, their quantities, or the number of packages 
on the airplane. By 0700, about 1 hour after the airplane had landed, the only information about 
the hazardous materials on board the airplane that had been provided to the initial incident 
commander came from the Part A form and a handwritten list provided by the FedEx station at 
the airport. This information indicated only the hazard classes of the hazardous materials on 
board the airplane and their location in the airplane by cargo container position. Emergency 
guidance about specific chemicals was available through the Orange County Hazardous Materials 
Response Team (HMRT) and its communications link to CHEMTREC; however, this 
information was of little use until the specific identity and quantities of the declared hazardous 
materials on board the airplane were known. About 0915, approximately 10 minutes before the 
fire was extinguished, the fire chief received from the Orange County HMRT coordinator a copy 
of the weight and load plan and a handwritten list identifying some of the chemicals on board. 

The NY ANG and other participating emergency response agencies, including airport 
operations at Stewart, repeatedly requested specific information about the hazardous materials on 
board the airplane. Throughout the morning (beginning at 0635) and into the early afternoon, 
FedEx, primarily through its Global Operations Command Center in Memphis, faxed as many as 
12 transmissions of various hazardous materials shipping documents to the emergency operations 
center at the airport operations building and the New York State Police barracks at Stewart, 
although many of the faxes were illegible. However, none of these reached the incident 
commander. 

Another problem was that FedEx did not have the capability to generate, in a timely 
manner, a single list indicating the shipping name, identification number, hazard class, quantity, 
number of packages, and the location of each declared shipment of hazardous materials on the 
airplane. To prepare such a list, FedEx would have had to compile information from copies of 
all of the individual Part Bs for each individual shipment of hazardous materials on the airplane. 
Because FedEx did not have the capability to quickly consolidate that information, it relied on 
faxing copies of the individual Part Bs for the approximately 85 hazardous materials packages on 
board, which proved to be burdensome, time consuming and, in this case, ineffective. Also, 
because of the poor quality and legibility of many of the handwritten Part Bs, much of the 
information was unusable. 

In contrast, railroads operating freight trains can generate a computerized list of all of the 
freight cars in the train that identifies which freight cars are transporting hazardous materials and 
provides the shipping name, hazard class, identification number, and type of packaging, quantity, 
and emergency response guidance for each hazardous material transported. Such a printed, 
comprehensive list can be generated quickly and thus the information can be provided in a timely 
fashion to the appropriate emergency responders and in a more useful format than numerous 
faxed copies of partially legible Part B forms. 

In both this accident and the July 31, 1997, crash of the FedEx MD-11 at Newark, the on¬ 
board Part B hazardous materials shipping papers were not available to emergency responders, 3 
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The Department of Transportation (DOT) hazardous materials regulations [49 CFR Part 173] require that 
the proper shipping name, hazard class, identification number, packaging group, and total quantity of the material 
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and FedEx was unable to provide complete information to emergency responders in a timely 
manner. Further, in two subsequent accidents (one near Clarksville, Tennessee, on March 5, 
1998, and the other at Bismarck, North Dakota, on April 7, 1998), the effectiveness of FedEx’s 
hazardous materials recordkeeping system was again called into question. In the Clarksville 
accident, the shipping papers on board the airplane and on file at FedEx’s Memphis Operations 
Center were found to be inaccurate. And in the Bismarck accident, FedEx was unable to confirm 
whether there were hazardous materials on board the airplane until 2 hours and 49 minutes after 
receiving the request for this information. 

Safety Board investigators surveyed the capability of other carriers to provide this 
information in similar circumstances and found that only one carrier had an on-line capability to 
provide detailed information about the hazardous materials on board its airplane. The remaining 
carriers, like FedEx, rely on paper copies of the hazardous material shipping documentation 
retained at the departing station if the on-board documentation is destroyed. The Safety Board is 
pleased that FedEx has committed to developing and implementing an electronic system for 
tracking and retrieving information about hazardous materials being carried on board FedEx 
flights. FedEx plans to implement intermediate and long-term plans that would make 
computerized information about hazardous materials information available from all FedEx 
facilities. However, the Safety Board does not agree with FedEx’s position that the proper 
shipping name is not relevant to emergency responders. Although this information may not 
always be required, in many cases it may be vital that emergency responders know exactly what 
substances are on board an aircraft so that appropriate measures can be taken to address potential 
risks. 


Compared to the other modes of transportation, it is less likely that shipping papers on 
board an accident aircraft will survive or be accessible because of the greater likelihood of fire 
and destruction of the airplane. Because of the danger of fire, a flightcrew is also less likely to 
have time to retrieve the shipping papers after a crash. The Safety Board concludes that the DOT 
hazardous materials regulations do not adequately address the need for hazardous materials 
information on file at a carrier to be quickly retrievable in a format useful to emergency 
responders. Therefore, the Safety Board believes that the Federal Aviation Administration and 
the Research and Special Programs Administration should require, within 2 years, that air 
carriers transporting hazardous materials have the means, 24 hours per day, to quickly retrieve 
and provide consolidated, specific information about the identity (including proper shipping 
name), hazard class, quantity, number of packages, and location of all hazardous materials on an 
airplane in a timely manner to emergency responders. 

As a result of the investigation of this accident, the National Transportation Safety Board 
recommends that the Research and Special Programs Administration: 

Require, within 2 years, that air carriers transporting hazardous materials have the 
means, 24 hours per day, to quickly retrieve and provide consolidated specific 
information about the identity (including proper shipping name), hazard class, 


appear on the shipping papers for any shipment of hazardous materials. Further, the regulations stipulate [49 CFR 
Part 175] that an operator must provide this information in writing to the pilot-in-command and that a copy of the 
shipping papers must accompany the shipment on board the airplane. 



quantity, number of packages, and location of all hazardous materials on an 
airplane in a timely manner to emergency responders. (A-98-80) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA, and BLACK concurred in these recommendations. 




National Transportation Safety Board 

Washington, D.C. 20594 

Safety Recommendation 


Date: August 20, 1998 

In reply refer to: A-98-83 


Honorable Jane F. Garvey 
Administrator 

Federal Aviation Administration 
Washington, D.C. 20591 


On February 20, 1997, Mesaba Airlines flight 3098, a de Havilland DHC-8-102, 
N828MA, operated as a Title 14 Code of Federal Regulations Part 121 flight, experienced an 
uncommanded left roll after departure from Detroit Wayne County Metropolitan Airport 
(DTW), Michigan. The flightcrew maintained control of the airplane with opposite aileron 
and aileron trim input. The captain reported that excessive right-wing-down trim was 
necessary to maintain a wings-level attitude and that the powered flight control surfaces 
(PFCS) display in the cockpit indicated that the left, outboard spoiler was deployed 
approximately 50 percent. The flightcrew depressurized the affected roll spoiler hydraulic 
circuit, but the spoiler remained in the partially extended position. The flightcrew declared an 
emergency, but the airplane landed at DTW without further incident. There were no injuries 
to the 3 crewmembers or 23 passengers on the airplane. Visual meteorological conditions 
prevailed at the time of the incident. 

Postflight examination of the airplane confirmed that the left, outboard roll spoiler 1 
remained partially deployed. The spoiler actuator was disassembled and examined by Dowty 
Aerospace (Dowty), the manufacturer of the actuator, and the National Transportation Safety 
Board. The examination revealed that the welded plug at the base of the actuator piston had 
separated and lodged between the piston and the housing. This restricted the piston’s travel 
and prevented its full retraction. 

The Safety Board has investigated two other incidents in which DHC-8 roll spoiler 
actuators became jammed in an extended position during flight. On January 22, 1997, a 


1 Each wing contains inboard and outboard roll spoilers that deploy proportionally with upward travel of the 
aileron. 
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Mesaba Airlines DHC-8, N852MA, experienced an uncommanded left roll during takeoff 
rotation at Charleston, West Virginia. The captain reported that he applied full left control 
wheel input to counter heavy left crosswinds experienced on the runway. The captain stated 
that the airplane rolled left during rotation and that substantial right aileron and rudder inputs 
were necessary to arrest the roll rate. The crew maintained aileron and rudder inputs to 
stabilize the roll and continued climbing while they performed the emergency checklist 
procedure for “airplane rolls with no control wheel input.” The flightcrew declared an 
emergency, but the landing was executed without further incident. The PFCS display and 
postflight inspection indicated that the left, inboard roll spoiler was extended approximately 50 
percent. Examination of the spoiler actuator revealed failure of the welded plug at the base of 
the actuator piston that prevented full retraction of the piston. 

The other incident involved a Mesaba Airlines DHC-8, N828MA, that experienced an 
uncommanded left roll during the approach to land at Moline, Illinois, on April 3, 1995. The 
flightcrew reported that right aileron was required to maintain wings-level flight. The 
flightcrew declared an emergency, but the airplane landed without further incident. The PFCS 
display and postflight inspection indicated that the left, inboard roll spoiler was extended 
approximately 50 percent. Examination of the spoiler actuators revealed a similar failure of 
the welded plug at the base of the actuator piston. 

In addition to the three incidents investigated by the Safety Board, Dowty reported that 
it is aware of seven additional actuators that experienced similar failure of the welded plug and 
jamming of the piston. All of the failures have been attributed to improper welds of the plug 
at the base of the piston. Failure of the piston plug allows hydraulic fluid to fill the interior 
chamber of the piston yet continue to actuate the piston. Failure of the piston plug does not 
affect hydraulic system integrity or operation of the actuator piston in the extended direction; 
however, it does prevent the actuator piston from fully retracting from an extended position. 

Dowty decided to discontinue manufacturing the welded-plug piston assemblies (part 
number (P/N) A50991-2) for the DHC-8 roll spoiler actuator and to purge its stock after the 
April 3, 1995, incident involving N828MA. A new piston assembly (P/N A44714-2) was 
introduced that incorporates a swaged piston blank in lieu of the welded-plug design. There 
have been no reported failures of the new piston assembly, which has been incorporated on all 
DHC-8 roll spoiler actuators manufactured or repaired by Dowty since April 1995. However, 
Dowty and de Havilland stated that most of the 516 actuators that were manufactured with the 
welded-plug design (only for DHC-8 airplanes) remain in service. 

On July 15, 1997, de Havilland issued an In-Service Activities Report (ISAR) to 
inform DHC-8 operators about this roll spoiler problem. The ISAR also referenced a pending 
Dowty service letter (subsequently issued on September 26, 1997), which provided details 
about modifying in-service actuators with the new piston assembly. The ISAR further stated 
that the problem involving the roll spoiler actuators “is not considered to be a safety issue” 
because it only affects operation of the roll spoiler through part of its stroke and is readily 
detectable. However, the Safety Board is concerned that the lateral asymmetry resulting from 
a jammed roll spoiler could be hazardous during certain operations that are frequently 
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encountered, such as flight at low airspeeds or during heavy crosswinds or turbulence. 
Accordingly, the Safety Board believes that the Federal Aviation Administration should require 
that operators of de Havilland DHC-8 airplanes replace the welded-plug piston assembly (P/N 
A50991-2) on Dowty roll spoiler actuators with a piston assembly using a swaged piston 
blank. 


Therefore, the National Transportation Safety Board recommends that the Federal 
Aviation Administration: 

Require that operators of de Havilland DHC-8 airplanes replace the welded-plug 
piston assembly (part number A50991-2) on Dowty Aerospace roll spoiler 
actuators with a piston assembly using a swaged piston blank. (A-98-83) 

Chairman HALL, Vice Chairman FRANCIS, and Members HAMMERSCHMIDT, 
GOGLIA, and BLACK concurred in this recommendation. 






f^g\ 


National Transportation Safety Board 

Washington, D.C. 20594 

Safety Recommendation 


Date: September 8, 1998 

In reply refer to: A-98-84 through -86 


Honorable Jane F. Garvey 
Administrator 

Federal Aviation Administration 
Washington, D.C. 20591_ 


On January 12, 1997, about 1026 Hawaiian standard time, a McDonnell Douglas 
Helicopter Systems (MDHS) 1 369D helicopter, N7012G, powered by one Allison 250-C20B 
turboshaft engine, lost engine power about 150 feet above ground level (agl) shortly after 
takeoff from a helipad near Kamuela, Hawaii. The pilot initiated an autorotation, but the 
helicopter landed hard in an open field, resulting in the main rotor blades severing the 
tailboom. The helicopter was substantially damaged; however, the pilot was not injured. No 
flight plan was filed, and visual meteorological conditions prevailed at the time of the accident. 
The flight was operated under Title 14 Code of Federal Regulations Part 91 as a personal 
flight. 


The MDHS 369 series (formerly Hughes 369 series) has one two-cell fuel tank. The 
airframe fuel system has a fuel tank boost pump to provide positive-pressure fuel delivery to 
the engine for starting. The engine-driven fuel pump provides high-pressure fuel to the fuel 
control unit (FCU), which meters fuel to the fuel nozzle. The fuel nozzle is a two-stage 
single-barrel fuel delivery device providing fuel to the engine for starting and fuel spray for 
continuous operation. The Allison 250 series engine has three fuel straining devices to prevent 
contaminants in the fuel from reaching the engine. The fuel pump has a two-stage filter with a 
bypass and pressure sensor to activate a warning light in the cockpit if the fuel flow through 
the filter is obstructed (impending bypass). The FCU has an inlet fuel screen with a bypass 
feature with no associated warning indication. The fuel nozzle has a fuel screen with neither a 
bypass feature nor an associated warning indicator. 

During the investigation of the Kamuela, Hawaii, accident, Safety Board investigators 
found that the fuel nozzle screen was contaminated with foreign material, including sodium 
chloride (salt). Contamination was also found in the fuel pump filter and FCU screen of the 
engine fuel system. 


1 The MDHS commercial helicopter division was recently acquired by Boeing Aircraft Company. 
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The maintenance records indicated that the helicopter had been inspected in accordance 
with the manufacturer’s recommended 100/300-hour inspection procedures about 21 flight 
hours before the accident. The inspection procedures did not include inspecting the fuel nozzle 
screen nor the FCU screen, but did include replacement of the engine fuel pump filter. The 
engine manufacturer’s inspection guidelines recommend that the fuel nozzle screen be 
inspected only when the engine fuel filter bypass light illuminates and/or the engine fuel pump 
filter is found to be contaminated. The maintenance records did not indicate a contaminated 
fuel filter during the 100/300-hour inspection nor had there been any reports of an illuminated * 

fuel filter bypass light. The fuel nozzle has an overhaul time limit of 2,500 flight hours with 
no requirement for regularly scheduled interim inspections. The accident nozzle had 
accumulated about 317 flight hours since overhaul. The engine had been operated in a salt * 

water environment, and its maintenance records showed that it had been subject to regular 
wash procedures (see enclosed Brief of Accident File No. 654). 

The Safety Board is aware of three similar accidents involving fuel nozzle screen 
contamination of Allison 250 series engines. On November 16, 1996, near Forks, 

Washington, a Hughes 369D helicopter, registration N5225C, lost engine power during an 
external load operation. The helicopter received substantial damage when it collided with trees 
during its autorotational descent. The investigation revealed contamination throughout the 
helicopter’s fuel system. The fuel filters were contaminated and in the bypass mode, and the 
fuel nozzle screen was found partially blocked by contaminants. The fuel contaminants were 
traced to the operator’s in-ground storage tanks (see enclosed Brief of Accident File No. 

1569). 


On April 14, 1996, near Yerington, Nevada, a Hughes 369D helicopter, registration 
N519BH, lost engine power during cruise flight at 200 to 300 feet agl. The subsequent 
engine-out emergency landing resulted in substantial damage to the helicopter. The helicopter 
had an annual inspection 6 months before the accident. The last compressor wash was 2 
months before the flight, and the helicopter had been flown 8 hours since the compressor 
wash. Examination of the FCU inlet screen and the fuel pump fuel filter did not reveal 
contaminants; however, the engine flamed out during the initial postaccident engine test run 
and experienced consistent engine power degradation in all tests. Inspection of the engine fuel 
nozzle after the test runs revealed a partially blocked screen (see enclosed Brief of Accident 
No. 689). 

On April 18, 1994, a Hughes 369D helicopter, registration N1103N, lost engine power 
during a sightseeing flight near Hanapepe, Hawaii. While maneuvering, the engine suddenly 
lost power, and, after an autorotation, the helicopter landed hard on rocky terrain. 
Examination of the engine fuel system revealed that the fuel nozzle screen was obstructed by 
contaminants, including salt. The helicopter was operated in a marine environment with 
substantial operations over the ocean. The maintenance procedures used by the company 
included daily engine compressor rinses (see enclosed Brief of Accident No. 1416). 

In addition to the above-mentioned accidents, investigators found a Federal Aviation 
Administration (FAA) maintenance periodical, Advisory Circular No. 43.16, titled “General 
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Aviation Airworthiness Alerts, ” which described an incident that involved an Allison 250-C20 
engine installed in a Hughes 369D helicopter. During flight, the engine reportedly lost power 
without warning; however, the pilot performed a successful autorotational landing. The 
investigation revealed a severely restricted fuel nozzle screen. The fuel nozzle’s historical 
flight hours and the contaminants blocking the screen were not reported. 

The Safety Board’s staff also found that numerous malfunction or defect reports of 
partially clogged Allison 250 engine fuel nozzles have been submitted by mechanics. These 
fuel nozzles are not removed based on a schedule provided by the manufacturer, but based on 
deteriorating engine performance or the mechanic’s personal experience. Because these 
measures have not proved adequate, corrective action is needed to address the engine power 
losses that have been caused by contamination of Allison 250 series fuel nozzle screens. The 
Safety Board believes that the FAA should direct all operators of helicopters powered by 
Allison 250 series engines to conduct a one-time inspection of all the engine fuel nozzle 
screens to ensure that they are intact, unobstructed, and functional. After the one-time 
inspection, the Safety Board believes that the FAA should determine appropriate inspection 
intervals for helicopters powered by Allison 250 series turboshaft engines and then require that 
periodic inspections be accomplished on those engine fuel nozzle screens to prevent the 
accumulation of contaminants that could alter the fuel delivery, engine performance, and 
ultimately clog the fuel nozzle screen and cause engine power loss. 

The Safety Board notes that of those occurrences known to the Board, all of the MDHS 
369 helicopters involved in fuel nozzle screen anomalies have not had an airframe-mounted 
fuel filter installed, which is optional on MDHS 369 series and some other makes of 
helicopters. Although the airframe-mounted fuel filter does not capture smaller particles than 
the fuel pump filter, the airffame-mounted filter does afford greater surface area filtration. 
Also, the fuel nozzles installed on Allison 250 series engines do not have a fail-safe design 
(bypass feature), even though a failure or obstruction of the nozzle results in complete loss of 
engine power. Therefore, the Safety Board believes that the FAA should determine if the 
optional airframe-mounted fuel filter on helicopters powered by Allison 250 series engines 
provides substantial improvement in the removal of fuel system contaminants, and, if so, 
require airframe-mounted fuel filters on those helicopters that do not already have them 
installed. 

Therefore, the National Transportation Safety Board recommends that the Federal 
Aviation Administration: 

Direct all operators of helicopters powered by Allison 250 series engines 
to conduct a one-time inspection of all the engine fuel nozzle screens to 
ensure that they are intact, unobstructed, and functional. (A-98-84) 

Determine appropriate inspection intervals for helicopters powered by 
Allison 250 series turboshaft engines and then require that periodic 
inspections be accomplished on those engine fuel nozzle screens to 
prevent the accumulation of contaminants that could alter the fuel 
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delivery, engine performance, and ultimately clog the fuel nozzle screen 
and cause engine power loss. (A-98-85) 

Determine if the optional airframe-mounted fuel filter on helicopters 
powered by Allison 250 series engines provides substantial improvement 
in the removal of fuel system contaminants, and, if so, require airframe- 
mounted fuel filters on those helicopters that do not already have them 
installed. (A-98-86) 


> 

Chairman HALL, Vice Chairman FRANCIS, and Member HAMMERSCHMIDT, 

GOGLIA, and BLACK concurred in these recommendations. 
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National Transportation Safety Board 

Washington D.C. 20594 

Safety Recommendation 



* Date: September 14 , 1998 

In reply refer to: A-98-109 through -110 


Honorable Jane F. Garvey 
Administrator 

Federal Aviation Administration 

Washington, D.C. 20591 _______ 

On October 15, 1997, about 1030 mountain daylight time, a Cessna P210N, 
N731NX, operated by the Sheriffs Department of Mesa County, Colorado, 
experienced an in-flight electrical fire while cruising at 16,500 feet over Bryce Canyon, 
Utah. The commercial pilot initiated an emergency descent and landed uneventfully in 
Bryce Canyon with minor damage. The pilot and his passenger were not injured. 
Visual meteorological conditions prevailed, and a visual flight rules flight plan had 
been filed. The public-use flight was conducted under Title 14 Code of Federal 
Regulations Part 91, and originated from Grand Junction, Colorado, about 60 minutes 
before the incident. 

The Safety Board’s investigation revealed that the fire originated on the cabin 
sidewall, under the left side of the instrument panel, and resulted in burned vinyl, 
v plastic, and insulation material. 1 The fire was caused by an overheated resistor used in 

an electric door seal inflation system. The resistor was used to reduce the 28-volt 
aircraft electrical system’s voltage to meet the power requirements of the door seal 
4 system’s 14-volt air pump motor. The system had been installed on the airplane in 

accordance with a Federal Aviation Administration (FAA)-approved supplemental type 
certificate (STC) 2 that was issued to the system’s manufacturer, Bob Fields 
Aerocessories, Inc., in 1983. The purpose of the system is to decrease in-flight cabin 


1 Bryce Canyon, Utah, October 15, 1997, Cessna P210N, N731NX (FTW98TA051). 

2 A supplemental type certificate can be issued by the FAA for design changes to type-certificated aircraft 
when the change is not so extensive as to require a new type certificate for that aircraft. STCs are 
typically approved for optional after-market kits that improve an aircraft design. The STC applicant must 
submit sufficient technical data to the FAA to show compliance with the applicable certification 
requirements. 
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noise caused by ill-fitting cabin doors. According to Bob Fields Aerocessories, about 
20,000 of these systems are currently installed in a wide variety of single- and twin- 
engine general aviation airplanes. 

Since the Bryce Canyon incident in October 1997, the Safety Board has 
investigated one accident and two incidents that also involved in-flight fires originating 
in electric inflatable door seal systems manufactured by Bob Fields Aerocessories. 
Moreover, a review of the FAA’s Service Difficulty Report database revealed four 
additional reports of overheated components associated with the door seal system, 
three of which cited smoke in the cockpit. A description of the recent accident and 
incidents investigated by the Safety Board follows. 

On November 20, 1997, a Beech 95-B55, N3681K, sustained substantial 
damage after impacting trees during a precautionary landing in Burlington, Kansas. 
The landing was precipitated by smoke and an electrical fire in the cabin during cruise 
flight at 6,500 feet. Postaccident examination of the airplane revealed that a Bob Fields 
Aerocessories electric door seal inflation pump, mounted on the forward side of the 
nose bulkhead, was heavily charred. The Safety Board determined that the probable 
cause of the accident was, in part, “the door seal inflation pump catching fire.” 3 


On June 25, 1998, the pilot of a Cessna P210N, N5083W, initiated a 
precautionary landing in Ithaca, New York, after heavy smoke had entered the cabin 
during cruise flight at 5,000 feet. Immediately after the landing, airport fire and rescue 
personnel discovered a self-sustaining fire originating under the left side of the 
instrument panel. Vinyl, plastic, and insulation material had burned in the fire. 
Subsequent examination of the airplane revealed that one of the resistors used in the 
Bob Fields Aerocessories electric door seal inflation system installed on the airplane 
was partially melted. 4 The Safety Board recently learned of a July 17, 1998, incident 
aboard a Beech 58 airplane in which the pilot reported a burning smell in the cockpit 
while in cruise flight. He landed in Toms River, New Jersey, and asked a mechanic to 
inspect the airplane. The mechanic reported that the pump assembly and resistors for 
the installed Bob Fields Aerocessories electric door seal inflation system, mounted in 
the nose compartment, were partially melted. 5 

The electric door seal inflation system manufactured by Bob Fields 
Aerocessories consists of an electric motor, an air pump, inflatable silicon door seals, a 
pressure sensing switch, an air supply control valve, a resistor assembly, a 7.5-amperes 
(amps) in-line fuse, a caution light, and electrical wiring. A 5-amp circuit breaker may 
also be provided as an option. The motor draws power directly from the airplane's 
battery bus and is used to inflate the door seals to a pressure of about 10 pounds per 


3 For more detailed information, see Brief of Accident CHI98LA041 (enclosed). 
4 Ithaca, New York, June 25, 1998, Cessna P210N, N5083W (NYC98SA138). 
5 Toms River, New Jersey, July 17, 1998, Beech 58, N53RD (NYC98SA167). 
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square inch (psi). A sensor on the air pump determines when the pressure drops below 
10 psi, at which time the air pump motor cycles back on until the proper pressure is 
achieved. According to the STC-holder, it takes between 4 and 12 seconds after 
system activation for the air pump to inflate the door seal; during this time, the caution 
light remains illuminated. If the door seal has a small leak, the pump cycles on and off 
to maintain the desired inflation pressure. If the door seal has a larger leak, the air 
pump may run continuously to keep the door seal inflated. 

The Safety Board’s review of the system design revealed that the system 
incorporates two identical 1-ohm resistors, each rated for a maximum of 50 watts. The 
resistors are wired close together and in series. According to technical specifications 
provided by the vendor of the resistor, the resistor’s wattage capability should be 
derated to no more than 20 watts if it is not mounted onto a sufficiently sized 
conductive structure for heat dissipation. Test data from the vendor further indicate 
that the aluminum housing of a single resistor will heat up to 313° F when the resistor 
carries the nominal wattage of the door seal inflation system and is adequately 
mounted to provide for heat dissipation. 6 The housing temperature rises to more than 
600° F if the resistor is not mounted to conductive material for heat dissipation. The 
potential for overheating is increased by the two resistors being wired closely together. 

The Safety Board reviewed the FAA-approved installation instructions for the 
Bob Fields Aerocessories electric inflatable door seal pump. The instructions state, 
“...be sure to mount the resistors pak [sic] to a metal plate to make a heat sink. This 
plate and resistors can be mounted at the parking brake support angle under the 
instrument panel.” No other instructions are found related to die resistor mounting. 
The investigations into the Bryce Canyon, Ithaca, and Toms River incidents revealed 
that the resistors were either hanging freely, or were mounted to structure in a manner 
that was insufficient to dissipate the heat generated by the resistors. The Safety Board 
is concerned that the installation instructions are insufficient and do not provide 
enough detail or cautions regarding the proper installation of the resistors and the 
minimum specifications for a heat sink. 

The Safety Board is also concerned about other aspects of the design of the 
door seal inflation system that can lead to the overheating of the resistors and other 
system components. The design calls for the system to be installed in confined areas 
on the aircraft. For example, in the two-door Cessna airplane models, the STC 
suggests that the system be mounted behind the pilot’s “kick panel.” The kick panel 
area is a confined space between the external skin of the airplane just forward of the 
door and an upholstered panel under the left side of the pilot’s instrument panel. This 
space has limited ventilation and inhibits the cooling required for a continuously 


6 The door seal inflation system draws a nominal current of 6 amps, thereby producing 36 watts of power 
through each 1-ohm resistor. Test data indicate that 36 watts of applied power through the specified 
resistor that is mounted on top of a box-shaped, aluminum chassis for heat conduction (0.040 inch thick, 5 
inches wide, 7 inches long, and 2 inches deep) will produce a housing temperature of 313° F. 
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operating electrical pump and its associated resistors. The space also provides 
potentially combustible materials in close proximity to heated electrical components, 
as illustrated by the Bryce Canyon and Ithaca incidents. 

Another aspect of the door seal inflation system design that could lead to 
overheating involves the endurance rating of the electrically driven air pump. 
According to the vendor that supplies the air pump to Bob Fields Aerocessories, the 
pump was originally designed to be plugged into an automotive cigarette lighter socket 
and was intended to be used for the emergency inflation of automobile tires. In a letter 
forwarded to the Safety Board, the vendor stated that the continuous use of the pump 
“should not exceed 10 minutes without stopping for 30 minutes” to prevent 
overheating. The application of the air pump for the pressurization of airplane door 
seals during flight is inappropriate because the pump may be required to operate for 
more than 10 minutes, or to run continuously if the door seal leaks. This was 
illustrated in the Bryce Canyon incident when the caution light was observed by the 
pilot to be continuously illuminated. The Safety Board is concerned that extended or 
continuous operation of the air pump will lead to excessive heat buildup, causing an 
excessive current draw, and will exacerbate the potential for overheating that already 
exists under the nominal current draw. 

Examination of the in-line fuses for the Bryce Canyon, Ithaca, and Toms River 
incidents revealed that a fuse rated for 10 amps had been installed in the door seal 
inflation system, exceeding the 7.5-amp-rated fuse specified by the approved STC 
installation instructions. The Safety Board notes that excessive current draw may 
result in frequent blown fuses and may prompt the improper installation of a higher¬ 
rated fuse. Although the improper use of a 10-amp-rated fuse increases the potential 
for overheating components, the use of the specified 7.5-amp-rated fuse would not 
eliminate the hazard because, as discussed above, testing has shown that overhea tin g 
of the resistors can occur at the nominal door seal inflation system current of 6 amps. 

The Safety Board is also concerned that the electric door seal inflation system 
design does not provide adequate warning of a potential overheat situation. The 
system incorporates an amber (caution) light on the pilot’s instrument panel that 
illuminates when the pump is operating. The STC installation instructions specify that 
a placard be placed near the light stating, “CAUTION/DOOR SEAL PUMP ON.” 
However, no information is provided on action to take if the light remains illuminated 
for an extended period. 

The Safety Board concludes that the Bob Fields Aerocessories door seal 
inflation system design does not provide owners or operators with adequate 
information about corrective action if the system begins to overheat. Also, it may not 
become apparent to an operator that the system is overheating until there are 
indications of an electrical fire. The system design does not incorporate its own 
electrical cut-off switch; therefore, the pilot’s only means to address an overheating 
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system or component is to turn off the airplane’s entire electrical power system using 
the master switch. 

The Safety Board is very concerned that these design deficiencies increase the 
likelihood of an in-flight electrical fire and/or smoke in the cockpit during flight, as 
evidenced by the accident and incidents discussed above, as well as additional 
incidents identified by SDRs. Therefore, the Safety Board believes that the FAA 
should issue an airworthiness directive to require that all owners and operators of 
airplanes equipped with electric door seal inflation pump systems manufactured by 
Bob Fields Aerocessories immediately disconnect them from the airplanes’ electrical 
systems. In addition, the FAA should review all STCs that provide for the installation 
of electric door seal inflation pump systems manufactured by Bob Fields 
Aerocessories, and require revisions, as necessary, to ensure that the hazards 
associated with in-flight fire and/or smoke in the cockpit during flight are eliminated. 
Existing systems should be required to comply with those instructions before they are 
placed back into service. 

Therefore, the National Transportation Safety Board recommends that the 
Federal Aviation Administration: 

Issue an airworthiness directive to require that all owners and 
operators of airplanes equipped with electric door seal inflation 
pump systems manufactured by Bob Fields Aerocessories 
imm ediately disconnect them from the airplanes’ electrical 
systems. (Urgent) (A-98-109) 

Review all supplemental type certificates that provide for the 
installation of electric door seal inflation pump systems 
manufactured by Bob Fields Aerocessories, and require 
revisions, as necessary, to ensure that the hazards associated with 
in-flight fire and/or smoke in the cockpit during flight are 
eliminated. Existing systems should be required to comply with 
those instructions before they are placed back into service. 
(A-98-110) 

Chairman HALL, Vice Chairman FRANCIS, and Members 
HAMMERSCHMIDT, GOGLIA, and BLACK concurred in these recommendations. 
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